Junos OS (SRX firewalls)
CVE-2026-102055: MX Series, PTX Series: An attacker causes remote code execution and denial of service when enhanced CFM is enabled
A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated adjacent-network attacker to execute arbitrary code as root or cause denial of service via a specific CFM Message sent to a configured down-MEP with enhanced CFM mode enabled.
Published Juniper Networks advisory JSA112187
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (MX Series) 0 | 23.2R2-S7.7 or later |
| Junos OS (MX Series) 23.4 | 23.4R2-S8.13 or later |
| Junos OS (MX Series) 24.2 | 24.2R2-S5.5 or later |
| Junos OS (MX Series) 24.4 | 24.4R2-S5 or later |
| Junos OS (MX Series) 25.2 | 25.2R2-S2 or later |
| Junos OS (MX Series) 25.4 | 25.4R1-S3 or later |
| Junos OS (MX Series) 26.2 | 26.2R1-S2 or later |
| Junos OS Evolved (PTX Series) 0 | 23.2R2-S7.7-EVO or later |
| Junos OS Evolved (PTX Series) 23.4 | 23.4R2-S8.11-EVO or later |
| Junos OS Evolved (PTX Series) 24.2 | 24.2R2-S5.6-EVO or later |
| Junos OS Evolved (PTX Series) 24.4 | 24.4R2-S5-EVO or later |
| Junos OS Evolved (PTX Series) 25.2 | 25.2R2-S2-EVO or later |
| Junos OS Evolved (PTX Series) 25.4 | 25.4R1-S3-EVO or later |
| Junos OS Evolved (PTX Series) 26.2 | 26.2R1-S2-EVO or later |
| Junos OS Evolved (PTX Series) 23.4X100 | See the advisory |
| Junos OS Evolved (PTX Series) 25.2X100 | 25.2X100-D35-EVO or later |
| Junos OS Evolved (PTX Series) 25.4X300 | 25.4X300-D40-EVO or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
A stack-based buffer overflow in the CFM daemon allows an unauthenticated attacker on an adjacent network to send a crafted message to a configured down-MEP. This flaw enables the execution of arbitrary code with root privileges or a denial of service, provided that enhanced CFM mode is enabled on the device.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated adjacent-network attacker to execute arbitrary code as root or cause denial of service via a specific CFM Message sent to a configured down-MEP with enhanced CFM mode enabled.
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.