Description
A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during CMP enrollment or automatic certificate re-enrollment.
Published: 2026-10-14
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

A NULL Pointer Dereference in the pkid component allows an unauthenticated remote attacker to force a server reset by sending a specially crafted packet during certificate enrollment or automatic reenrollment. The flaw results in a clear denial of service, disrupting Junos OS operation without granting any additional privileges. The weakness corresponds to CWE‑476, indicating a failure to validate a null reference before use.

Affected Systems

Juniper Networks Junos OS versions 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all subsequent releases are impacted; older respins of 23.2, 23.4, and 24.2 have been rebuilt to address this issue.

Risk and Exploitability

The advisory assigns a CVSS score of 8.7, classifying the vulnerability as high severity. EPSS data is unavailable, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely over an untrusted network by transmitting a malformed packet during CMP enrollment, requiring no authentication or privileged access. Due to the lack of a technical workaround, devices remain susceptible until the patched releases are deployed.

Generated by OpenCVE AI on October 14, 2026 at 21:39 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases. Note: For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

Vendor Workaround

There are no known workarounds for this issue.

OpenCVE Recommended Actions

  • Upgrade Junos OS to any of the releases listed in the vendor update - for example, 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, or 26.4R1. Any newer release also contains the fix.
  • If an upgrade cannot be performed immediately, block or rate‑limit CMP enrollment traffic to prevent denial of service attempts during the window of vulnerability.
  • Continuously monitor Junos OS event logs and network traffic for repeated malformed certificate enrollment packets and be prepared to restart affected devices if service interruption occurs.

Generated by OpenCVE AI on October 14, 2026 at 21:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during CMP enrollment or automatic certificate re-enrollment.
Title Junos OS: Malformed packet causes pkid denial of service when certificate re-enrollment is used
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-10-14T20:46:21.926Z

Reserved: 2026-09-28T16:31:35.503Z

Link: CVE-2026-101973

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-14T17:17:49.900

Modified: 2026-10-14T21:17:24.023

Link: CVE-2026-101973

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-14T21:45:07Z

Weaknesses