Junos OS CVE-2026-101927

Exploitation requires local access to the device as an unprivileged user with the ability to send crafted IPC event messages to the eventd daemon on Junos OS or Junos OS Evolved; no network path exists (AV:L). The affected component is eventd, present across all platforms per the advisory, so no special non-default feature or configuration is called out as required. The primary limiting factor is the need for a pre-existing local account or shell/CLI foothold on the device - remote, unauthenticated, network-based exploitation is not possible, which substantially narrows the realistic attacker population to insiders, compromised low-privilege accounts, or post-foothold escalation scenarios.

The CVSS 4.0 base score of 8.6 is driven by high confidentiality, integrity and availability impact (VC:H/VI:H/VA:H) combined with low attack complexity and no required privileges or user interaction. The single most important mitigating signal, however, is the attack vector: AV:L means this is NOT remotely exploitable over the network - the attacker must already have local access to the device. The description reinforces this by specifying an 'unprivileged local attacker.' There is no EPSS score, no CISA KEV listing, and no public exploit code referenced in the available data, so this is 'no public exploit identified at time of analysis' rather than an actively-exploited emergency. Note a tension worth verifying with the vendor: the vendor vector sets PR:N (no privileges), yet the description requires an 'unprivileged local attacker,' which implies the adversary must still possess a valid low-privilege local account on the device - a real precondition that meaningfully reduces exposure on hardened, single-administrator appliances. In practice this is a serious but not drop-everything issue: it is a high-value local privilege-escalation/DoS primitive (root compromise of a core network device) that becomes a genuine priority specifically where untrusted or semi-trusted users can obtain shell/CLI access, or where it is chained after an initial network foothold.

An attacker who has already obtained an unprivileged local account or shell on a Junos OS / Junos OS Evolved device (e.g., a limited-access operator, or via a prior foothold) sends specially crafted IPC event messages to the eventd process. The malformed messages trigger a heap-based buffer overflow in eventd, which runs with elevated privileges, allowing the attacker to crash the daemon (denial of service) or corrupt heap memory to achieve code execution as root. No public exploit is identified at time of analysis, and because the attack vector is local (AV:L), exploitation is not possible from the network.