Act nowDisclosed

Advisory · CVE-2026-102175

Heap overflow in Junos sdxd lets a rogue service-deployment peer run code as root

A heap-based buffer overflow in the sdxd service-deployment daemon of Junos OS and Junos OS Evolved lets a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection execute code as root or cause a denial of service with a crafted frame. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-102175
CWE-122
Action timing
Immediate
ELI5

Explain it like I’m five

The daemon that deploys services trusts frames from its server connection enough to overflow on them, and it runs as root.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Attacker reaches the channel

    The attacker controls or intercepts the configured SDX/SRC server connection.

  2. 02Crafted frame sent

    A malformed frame is delivered over the service-deployment TCP connection.

  3. 03sdxd overflows

    The heap overflow executes code as root or crashes the daemon.

What happened

Juniper disclosed CVE-2026-102175 in its October 2026 security release: a heap-based buffer overflow (CWE-122) in the sdxd service-deployment daemon of Junos OS and Junos OS Evolved. An attacker who can control or intercept the configured SDX/SRC server connection can send a crafted frame over the service-deployment TCP connection to execute code as root or deny service.

Juniper’s JSA112187 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for sdxd crashes and unexpected frames or connections on the service-deployment channel.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Anything that can impersonate the SDX/SRC server owns the device. Patch, and make sure that management channel is segmented and authenticated.