Junos OS (SRX firewalls)
CVE-2026-102060: MX Series, ACX Series: An attacker causes a routing daemon crash when multicast lawful intercept is used
A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause a denial of service via an IGMPv3 membership report received on a directly connected network.
Published Juniper Networks advisory JSA112187
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (MX Series) 0 | 23.2R2-S7.7 or later |
| Junos OS (MX Series) 23.4 | 23.4R2-S8.13 or later |
| Junos OS (MX Series) 24.2 | 24.2R2-S5.5 or later |
| Junos OS (MX Series) 24.4 | 24.4R2-S5 or later |
| Junos OS (MX Series) 25.2 | 25.2R2-S2 or later |
| Junos OS (MX Series) 25.4 | 25.4R1-S3 or later |
| Junos OS (MX Series) 26.2 | 26.2R1-S2 or later |
| Junos OS Evolved (ACX Series) 0 | 23.2R2-S7.7-EVO or later |
| Junos OS Evolved (ACX Series) 23.4 | 23.4R2-S8.11-EVO or later |
| Junos OS Evolved (ACX Series) 24.2 | 24.2R2-S5.6-EVO or later |
| Junos OS Evolved (ACX Series) 24.4 | 24.4R2-S5-EVO or later |
| Junos OS Evolved (ACX Series) 25.2 | 25.2R2-S2-EVO or later |
| Junos OS Evolved (ACX Series) 25.4 | 25.4R1-S3-EVO or later |
| Junos OS Evolved (ACX Series) 26.2 | 26.2R1-S2-EVO or later |
| Junos OS Evolved (ACX Series) 23.4X100 | See the advisory |
| Junos OS Evolved (ACX Series) 25.2X100 | 25.2X100-D35-EVO or later |
| Junos OS Evolved (ACX Series) 25.4X300 | 25.4X300-D40-EVO or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
A flaw in the routing protocol daemon of Juniper Networks Junos OS allows an unauthenticated attacker on a directly connected network to trigger a NULL pointer dereference. By sending a specific IGMPv3 membership report, the attacker can crash the rpd process, resulting in a denial of service. No user interaction or prior authentication is required to exploit this vulnerability.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause a denial of service via an IGMPv3 membership report received on a directly connected network.
Am I affected?
[ services flow-tap ]
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.