CVE-2026-102056
7.1HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-125
Impact
An adjacent unauthenticated attacker can crash the cfmd daemon to cause a denial of service and leak limited process memory. They only need local network access to send crafted CFM messages to an interface running CFM.
Root cause
An out-of-bounds read flaw exists in the cfmd process when parsing specific CFM messages.
Affected systems
Juniper Networks Junos OS and Junos OS Evolved (specific versions not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Fix & remediation
Upgrade to the patched Junos OS or Junos OS Evolved release specified in advisory JSA112187. If you cannot upgrade immediately, disable CFM (Connectivity Fault Management) on untrusted or exposed interfaces.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon and disclose limited process memory via a specific CFM Message sent to a configured interface.