Juniper Junos CVE-2026-102015

Exploitation requires an interface explicitly configured for 802.1X (dot1x) port-based authentication, served by the secure-dot1xd process on Junos OS or Junos OS Evolved - interfaces without 802.1X enabled are not reachable by this attack surface. The attacker needs no credentials (PR:N) and no user interaction (UI:N), but MUST have adjacent-network (Layer 2) reachability to the authenticated interface (AV:A): a compromised or rogue host on the same segment, or physical access to a switch port. The principal limiting factors are therefore (1) the non-default prerequisite that 802.1X authentication be configured on the targeted interface, and (2) the adjacency requirement, which prevents remote/internet-based exploitation and confines realistic threat actors to those with local L2 or physical access.

This is a genuinely high-priority flaw for affected Juniper deployments, though its exposure is bounded by the adjacency requirement. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) indicates an adjacent-network, low-complexity, unauthenticated attack with no user interaction and no special attack requirements, yielding high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) - consistent with the described root-level code execution. The 8.7 'High' score is credible and not merely inflated: heap overflow leading to RCE as root on network infrastructure is severe. The key mitigating signal is AV:A (adjacent, not network/AV:N): the attacker must be on the same Layer 2 segment as an 802.1X-authenticated interface, which rules out direct internet-based mass exploitation and points toward insider, compromised-endpoint, or physical-access scenarios. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk is currently theoretical-but-serious rather than proven-in-the-wild. The SA:L (subsequent-system availability, Low) and SC:N/SI:N indicate impact is largely confined to the vulnerable device without a scope change to other systems. Overall: treat as a priority patch for environments running 802.1X on Junos, but the adjacency constraint and absence of exploitation signals argue against emergency panic where physical/L2 access is well controlled.

An attacker with access to the local Layer 2 segment - for example via a compromised endpoint, rogue device, or physical port on an 802.1X-enabled access switch - crafts a malformed EAPOL frame and sends it to an interface configured for 802.1X authentication. The secure-dot1xd process mishandles the frame, triggering a heap-based buffer overflow that either crashes the daemon (denial of service) or is leveraged to execute arbitrary code as root on the Junos device. No public exploit code is identified at time of analysis, and exploitation requires adjacency rather than remote internet access.