High priorityDisclosed

Advisory · CVE-2026-102061

Stack overflow in Junos phone-home daemon lets a DHCP SZTP message run code as root

A stack-based buffer overflow in the phone-home daemon (phcd) of Junos OS and Junos OS Evolved lets an adjacent unauthenticated attacker execute arbitrary code as root via a crafted DHCP SZTP bootstrap message, on platforms that support Secure-ZTP. Juniper rates it CVSS 3.1 8.8.

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-102061
CWE-121
Action timing
Immediate
ELI5

Explain it like I’m five

The secure bootstrap message overflows the daemon before the device has finished becoming itself.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01SZTP bootstrap begins

    A Secure-ZTP platform starts bootstrap and processes DHCP-provided data.

  2. 02Crafted bootstrap message sent

    An adjacent attacker supplies an SZTP bootstrap message built to overflow phcd.

  3. 03Root code execution

    The stack overflow executes arbitrary code as root.

What happened

Juniper disclosed CVE-2026-102061 in its October 2026 security release: a stack-based buffer overflow (CWE-121) in the phone-home daemon (phcd). A crafted DHCP SZTP bootstrap message can execute arbitrary code as root on platforms that support Secure-ZTP.

Juniper’s JSA112187 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for phcd crashes during provisioning and SZTP bootstrap messages with unusual sizes.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Same daemon, same provisioning window as CVE-2026-102059. One patch, one hardened provisioning process covers both.