External risk intelligence

Juniper Junos OS Evolved Kernel Panic via Crafted TCP Packet

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-102068

The vulnerability affects BGP or LDP protocol handling within the network kernel. These protocols are commonly exposed at the network edge and on infrastructure devices such as routers, which are frequently reachable via the internet or across interconnected network segments to facilitate routing and peering operations.

Buffer Overflow

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Juniper Networks Junos OS Evolved that could allow an unauthenticated remote attacker to cause a kernel panic. This issue is related to how the system handles specific network traffic when using key-chain authentication for BGP or LDP. The primary concern is confirming if our environment is affected and understanding the potential exposure.

A network flaw can crash critical Juniper devices.
It impacts core routing and signaling protocols.
Confirm relevance and exposure to Juniper devices.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted TCP packets to a Juniper Networks Junos OS Evolved device. This is possible without any authentication, and the crafted packet targets the kernel's handling of routing protocols like BGP or LDP when key-chain authentication is in use. Successfully triggering the vulnerability could lead to a kernel panic.

Network exposure required.
Crafted TCP packet triggers overflow.
Kernel panic, potential denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the stability of Juniper Networks Junos OS Evolved devices when key-chain authentication is used for BGP or LDP. An unauthenticated remote attacker could trigger a kernel panic by sending a crafted TCP packet. This could lead to a denial of service, affecting the routing and signaling capabilities of the affected device.

Device stability and routing functions at risk.
Crafted TCP packets could trigger kernel panic.
Service disruption due to kernel panic.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Juniper Networks Junos OS Evolved, specifically affecting BGP and LDP services when key-chain authentication is enabled. Infrastructure and network security teams are likely responsible for addressing this issue. The initial practical step involves identifying all Junos OS Evolved systems, determining their exposure, confirming business criticality, and then coordinating remediation efforts.

Network and Infrastructure teams own remediation.
Verify BGP/LDP reachability and keychain usage.
Plan maintenance for affected systems.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Juniper Junos OS Evolved?

Junos OS Evolved is a modular, Linux-based network operating system used by Juniper Networks to power high-performance routing and switching hardware. It provides the control plane software that manages how data traffic moves across complex network infrastructures. By decoupling the core OS from the hardware, it aims to increase device reliability and speed up the deployment of new routing features for service providers and large-scale enterprise data centers.

What does CWE-121 mean for CVE-2026-102068?

CWE-121 refers to a Stack-based Buffer Overflow. In this CVE, it means the system's kernel lacks sufficient checks when processing incoming data. When a specifically crafted TCP packet is received, it attempts to write more information into a fixed-length memory buffer on the stack than it can hold. This memory corruption overwrites adjacent data, causing the system to crash—a condition known as a kernel panic.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted TCP packet to the device. The vulnerability specifically affects the kernel's handling of BGP or LDP protocols when key-chain authentication is active. If your device does not use key-chain authentication for these protocols, or if the traffic is blocked from reaching the kernel, the condition cannot be triggered.

Why does Halo Surface Signal flag this as likely relevant?

Halo Surface Signal flags this as likely relevant because the vulnerability targets BGP and LDP, which are fundamental protocols for routing. These protocols are often processed by devices situated at the network edge to enable peering and connectivity. Because these systems are frequently reachable via the internet or across interconnected network segments to perform their routing duties, the potential for unauthorized remote interaction is elevated.

Do I need to check my Juniper devices for this vulnerability?

Yes. Start by inventorying all devices running Junos OS Evolved to see if they utilize BGP or LDP services. For those that do, confirm if key-chain authentication is currently enabled, as this is the specific trigger condition. Once identified, prioritize these devices for maintenance planning while coordinating with your network infrastructure teams to track upcoming security updates.

References

supportportal.juniper.net/JSA112250

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.