Junos OS (SRX firewalls)
CVE-2026-102069: An ICCP peer causes dot1xd to crash when dot1x synchronization is enabled
A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker acting as the configured ICCP peer to cause a denial of service and potentially execute code as root via.
Published Juniper Networks advisory JSA112188
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS 0 | 23.2R2-S7.7 or later |
| Junos OS 23.4 | 23.4R2-S8.13 or later |
| Junos OS 24.2 | 24.2R2-S5.5 or later |
| Junos OS 24.4 | 24.4R2-S5 or later |
| Junos OS 25.2 | 25.2R2-S2 or later |
| Junos OS 25.4 | 25.4R1-S3 or later |
| Junos OS 26.2 | 26.2R1-S2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
An adjacent attacker acting as the configured ICCP peer can exploit a stack-based buffer overflow in the dot1x daemon of Junos Fusion Aggregation Devices. This flaw allows the attacker to cause a denial of service and potentially execute code with root privileges. The attack requires no authentication or user interaction and is triggered when dot1x synchronization is enabled for the required Fusion satellite topology.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker acting as the configured ICCP peer to cause a denial of service and potentially execute code as root via. The issue is triggered when dot1x synchronization is enabled for the required Fusion satellite topology.
Am I affected?
[ chassis satellite-management redundancy-groups chassis-id ] [ protocols dot1x authenticator interface ] [ protocols iccp peer ]
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.