Key points
- Juniper Networks Junos OS versions before specific service releases are vulnerable to CVE-2026-102175.
- The flaw allows unauthenticated remote attackers to execute code as root via the service-deployment daemon.
- No fix has been confirmed yet for versions older than the listed service release cutoffs.
Juniper Networks Junos OS and Junos OS Evolved versions prior to specific service releases are affected by a critical vulnerability. The flaw, tracked as CVE-2026-102175, resides in the sdxd service-deployment daemon. According to the National Vulnerability Database, this issue allows remote unauthenticated attackers to execute code as root or cause denial of service.
In plain English
The sdxd daemon handles service deployment tasks on these network devices. A heap-based buffer overflow exists in this component. If an attacker can control or intercept the configured SDX or SRC server connection, they can send a crafted frame over the service-deployment TCP connection. This action triggers the overflow, leading to full system control or service disruption.
The background
The NVD rates this vulnerability with a CVSS score of 9.8, marking it as critical. The weakness is classified as CWE-122, a heap-based buffer overflow. The affected software includes Junos OS before 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, and 24.4R2-S5. Junos OS Evolved versions before 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, and 24.4R2-S5-EVO are also at risk.
What changes now
Network administrators must verify their current software versions against the affected list. Systems running versions older than the specified service releases are exposed. Since the vulnerability allows unauthenticated remote access, any device with the sdxd daemon accessible via the SDX/SRC server connection is a potential target. Immediate assessment of exposure is required to prevent unauthorized root-level access.
Who needs to act first
Teams should prioritize systems exposed to untrusted networks or where the SDX/SRC connection traverses insecure links. Verify which devices run vulnerable versions before attempting updates. Back up current configurations to ensure recovery options exist if an update fails. Test patches in a non-production environment first to confirm stability. Restrict access to the service-deployment TCP port if immediate updating is not possible.
What to do and how to stay safe: Juniper Networks
- Check your inventory for Junos OS and Evolved versions listed as affected.
- Review firewall rules to limit access to the service-deployment TCP connection.
- Monitor logs for unusual activity on the sdxd daemon or SDX/SRC links.
- Plan to update to the specified service releases once available.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-102175?
It is a critical heap-based buffer overflow in the Juniper sdxd daemon allowing remote root code execution or denial of service.
Which Juniper products are affected?
Junos OS and Junos OS Evolved versions prior to specific service releases like 23.2R2-S7.7 and 24.4R2-S5 are affected.
Is there a fix available?
No fix has been confirmed yet for versions older than the listed service release cutoffs in the NVD record.
