High priorityDisclosed

Advisory · CVE-2026-102055

Stack overflow in Junos cfmd lets a CFM message run code as root on MX and PTX

A stack-based buffer overflow in the cfmd process of Junos OS on MX Series and Junos OS Evolved on PTX Series lets an unauthenticated adjacent-network attacker execute arbitrary code as root or deny service via a specific CFM message sent to a configured down-MEP with enhanced CFM mode enabled. Juniper rates it CVSS 3.1 8.8.

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-102055
CWE-121
Action timing
Immediate
ELI5

Explain it like I’m five

An Ethernet OAM message, meant for fault checks between providers, can overflow the daemon and hand over root.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01CFM message sent

    An adjacent unauthenticated attacker sends a specific CFM message to a configured down-MEP.

  2. 02cfmd stack overflows

    With enhanced CFM mode enabled, cfmd mishandles the message and its stack overflows.

  3. 03Root code or denial of service

    The overflow executes code as root or disrupts the device.

What happened

Juniper disclosed CVE-2026-102055 in its October 2026 security release: a stack-based buffer overflow (CWE-121) in cfmd, affecting Junos OS on MX Series and Junos OS Evolved on PTX Series. A specific CFM message to a configured down-MEP with enhanced CFM mode enabled can execute arbitrary code as root or deny service.

Juniper’s JSA112187 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for cfmd crashes and CFM messages with unusual sizes reaching down-MEP interfaces.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Carrier Ethernet OAM crosses organizational boundaries by design. Patch MX and PTX platforms running enhanced CFM.