High priorityDisclosed

Advisory · CVE-2026-102049

Stack overflow in Junos l2cpd lets LLDP traffic run code as root on UAP interfaces

A stack-based buffer overflow in the l2cpd process of Junos OS and Junos OS Evolved lets an adjacent unauthenticated attacker deny service or execute arbitrary code with root privileges via LLDP traffic received on an interface with Unified Access Policy enabled. Juniper rates it CVSS 3.1 8.8.

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-102049
CWE-121
Action timing
Immediate
ELI5

Explain it like I’m five

A discovery protocol frame, the kind devices exchange automatically, can overflow the Layer 2 daemon and run code as root.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01LLDP frame received

    An adjacent unauthenticated attacker sends LLDP traffic to a UAP-enabled interface.

  2. 02l2cpd stack overflows

    The daemon mishandles the frame and its stack buffer overflows.

  3. 03Root code or denial of service

    The overflow executes code as root or disrupts Layer 2 processing.

What happened

Juniper disclosed CVE-2026-102049 in its October 2026 security release: a stack-based buffer overflow (CWE-121) in l2cpd. LLDP traffic received on an interface with Unified Access Policy enabled can trigger it from an adjacent, unauthenticated position.

Juniper’s JSA112187 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for l2cpd crashes and LLDP frames with unusual type-length-value sizes on access interfaces.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

LLDP is enabled by default in many closets. Patch access switches and trim LLDP where it is not needed.