Description
An Out-of-bounds Write Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to cause a denial of service via a crafted frame received on an LACP-enabled aggregated-Ethernet member port.
Published: 2026-10-14
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply patch
AI Analysis

Impact

An out‑of‑bounds write flaw in the lacpd process of Juniper Networks Junos OS Evolved permits a Layer‑2‑adjacent attacker to crash the LACP daemon by sending a crafted frame. The resulting crash can stop LACP‑enabled aggregated Ethernet member ports from functioning, causing a denial of service to services that depend on the affected Link Aggregation Control Protocol interface. The weakness is classified as an out-of-bounds write (CWE-787).

Affected Systems

Juniper Networks Junos OS Evolved is vulnerable in multiple releases, including 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases. Administrators should verify that any affected device is running a patched version of the operating system.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting there is currently no known widespread exploitation. However, a local attacker who can inject a malicious frame into an LACP-enabled member port can exploit the flaw. The attack vector is Layer‑2 and requires proximity to the network segment carrying the aggregated links.

Generated by OpenCVE AI on October 14, 2026 at 22:36 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS Evolved: 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases.

Vendor Workaround

There are no known workarounds for this issue.

OpenCVE Recommended Actions

  • Upgrade Junos OS Evolved to any of the patched releases listed by Juniper
  • If an upgrade cannot be performed immediately, disable LACP on the affected interfaces to prevent the flaw from being exploited
  • Apply network segmentation or restrict Layer‑2 adjacency to trusted devices so that only authorized traffic can reach the vulnerable interfaces

Generated by OpenCVE AI on October 14, 2026 at 22:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description An Out-of-bounds Write Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to cause a denial of service via a crafted frame received on an LACP-enabled aggregated-Ethernet member port.
Title Junos OS Evolved: An crafted LACP frame causes lacpd to crash when LACP is enabled
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-10-14T20:26:09.789Z

Reserved: 2026-09-28T17:35:40.522Z

Link: CVE-2026-102045

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-14T17:17:58.953

Modified: 2026-10-14T21:17:29.840

Link: CVE-2026-102045

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-14T22:45:07Z

Weaknesses