Juniper's October 2026 security bulletin covers nine critical Junos OS and Junos OS Evolved vulnerabilities, and most of them assume the attacker already has a foothold in the control plane or the management plane. CVE-2026-102175 is the exception worth reading twice. It sits in the service-deployment daemon, needs no credentials, and ends in root code execution or a denial of service on the routing engine itself.

Vulnerability overview

CVE-2026-102175 is a heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved. NVD records a CVSS v3.1 base score of 9.8 and a CVSS v4.0 base score of 9.3, both critical, with the v3.1 vector describing a network-reachable, low-complexity, unauthenticated attack that compromises confidentiality, integrity and availability. The entry was published on 2026-10-14 and carries the status "Awaiting Analysis", meaning the description and score come from the CNA rather than from a completed NVD enrichment pass.
The flaw belongs to the memory-safety family that has dominated router advisories for years: a length or size assumption in parsing code is violated, and a copy writes past the end of an allocation on the heap.

Mechanism and exploitation conditions

According to the vendor description, the overflow is triggered by a crafted frame received over the service-deployment TCP connection. Successful exploitation requires a specific position: the attacker must be able to control or intercept the configured SDX/SRC server connection that the device talks to for service deployment.
That precondition matters more than the score. Nobody reaches this by pointing a scanner at a Junos box. The attacker must sit on the path to, or control, the SDX/SRC endpoint the router has been configured to trust. In practice that means three realistic paths: compromising the SDX/SRC server itself, spoofing or hijacking the connection through network position, or abusing a misconfigured deployment topology where the SDX/SRC address resolves to something the attacker controls.
Once that position is achieved, the crafted frame overflows a heap buffer. The vendor describes the outcome as code execution as root or a denial of service. Root on the routing engine is the worst case for a Junos device: the attacker inherits the full configuration, the routing protocols, the cryptographic material used for management, and the ability to persist.
The public record at the time of writing does not include proof-of-concept code, exploitation details, or a statement that the flaw has been exploited in the wild. NVD still lists the CVE as awaiting analysis, and CISA's Known Exploited Vulnerabilities catalog, version 2026.10.23, does not contain CVE-2026-102175 or any of its eight siblings from the same bulletin.

Impact

A root-level compromise of a routing engine is not a single-device problem. The device holds routing adjacencies, policy, VPN keys and often the trust anchor for the whole network segment. An attacker who reaches root can rewrite forwarding behaviour, sample or redirect traffic, and modify configuration in ways that survive a reboot if they also touch the boot environment. The denial-of-service path is narrower but still operationally serious: a crash of the service-deployment daemon can interrupt management workflows precisely when an operator needs them.
Because the vulnerability is pre-authentication, the usual mitigation of strong management credentials does nothing. Only network placement and patching help.

Affected products and scope

The bulletin enumerates fixed builds for both operating systems. For Junos OS, all versions prior to 23.2R2-S7.7 are affected, together with 23.4 before 23.4R2-S8.13, 24.2 before 24.2R2-S5.5, 24.4 before 24.4R2-S5, 25.2 before 25.2R2-S2, 25.4 before 25.4R1-S3 and 26.2 before 26.2R1-S2.
For Junos OS Evolved, the affected ranges are all versions prior to 23.2R2-S7.7-EVO, 23.4 before 23.4R2-S8.11-EVO, 24.2 before 24.2R2-S5.6-EVO, 24.4 before 24.4R2-S5-EVO, 25.2 before 25.2R2-S2-EVO, 25.4 before 25.4R1-S3-EVO, 26.2 before 26.2R1-S2-EVO, plus the 23.4X100-EVO branch and 25.2X100 before 25.2X100-D35-EVO and 25.4X300 before 25.4X300-D40-EVO.
One scoping question deserves an explicit answer rather than an assumption: exposure depends on whether service deployment through SDX/SRC is configured on the device at all. An operator who has never enabled that workflow has a much smaller attack surface for this specific CVE, though the same device may still be exposed to the sibling flaws in the bulletin.

Exposure context

A ZoomEye query for app="Juniper" returned 343,949 matching assets, well above any reasonable threshold for treating Juniper routing and security platforms as an internet-visible population. That number measures Juniper product assets seen by the scanner. It does not measure how many run Junos, how many run an affected release, and certainly not how many have SDX/SRC service deployment configured. Treat it as context for prioritisation, not as an inventory of vulnerable devices.

Remediation and validation

Juniper's guidance is to move to the fixed builds listed for the relevant branch. Where an immediate upgrade is not possible, the practical controls are network-level: ensure the configured SDX/SRC endpoint is a trusted host on a management segment that is not reachable from untrusted networks, and monitor the device for unexpected changes to service-deployment configuration.
Validation after upgrading should confirm the running release on every routing engine, not just the primary, and should also confirm that the sibling CVEs from the same bulletin are addressed by the same build. A single maintenance window that closes one CVE but leaves eight open is not a successful change.

References

  • Juniper security bulletin, October 2026: https://supportportal.juniper.net/s/article/2026-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Multiple-vulnerabilities-resolved

  • NVD record for CVE-2026-102175: https://nvd.nist.gov/vuln/detail/CVE-2026-102175

  • NVD record for CVE-2026-101954: https://nvd.nist.gov/vuln/detail/CVE-2026-101954

  • CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog