Junos OS CVE-2026-102056

Exploitation requires that Connectivity Fault Management (CFM / IEEE 802.1ag) be explicitly configured on a reachable interface - on devices without CFM configured, the cfmd process is not exposed and the attack does not apply. The attacker must be on the adjacent network (AV:A: same Layer 2 segment or directly connected link) and send the crafted CFM message to that configured interface; no authentication (PR:N) and no user interaction (UI:N) are needed. The principal limiting factors are therefore the non-default CFM configuration requirement and the Layer 2 adjacency constraint, which together prevent remote internet-based exploitation and confine the threat to attackers with local network presence.

This is a moderate-priority, bounded availability/disclosure flaw rather than a critical remote-code-execution threat. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) confirms unauthenticated exploitation but restricts the attacker to the adjacent network (Layer 2 / directly-connected segment), which materially limits reach compared to an internet-facing AV:N flaw. Impact is split: availability is high (VA:H - the cfmd daemon crashes) while confidentiality is only limited (VC:L - disclosure of limited process memory) and integrity is none (VI:N). No EPSS score was provided, there is no CISA KEV listing, and no public exploit was referenced, so exploitation status is 'no public exploit identified at time of analysis'. The signals are internally consistent - low complexity and no privileges make exploitation technically easy, but the adjacency requirement and the requirement that CFM be explicitly configured on a reachable interface sharply narrow the realistic attack surface. Net: patch promptly on devices where CFM is enabled and adjacent-network trust is weak, but this is not a drop-everything internet-exposed emergency. Missing data to note explicitly: EPSS probability is absent and cannot be used to gauge exploitation likelihood; POC/KEV absence is confirmed-negative only to the extent of the provided intelligence.

An attacker positioned on the same Layer 2 broadcast domain as a Junos device (e.g., a compromised host or rogue device on a shared VLAN/Ethernet segment) sends a specially crafted CFM (Connectivity Fault Management / 802.1ag) frame to an interface that has CFM configured. The malformed message triggers an out-of-bounds read in the cfmd process, crashing the daemon and causing it to leak a limited amount of process memory. No authentication or user interaction is required, but the attacker must be adjacent and the target interface must be running CFM; no public exploit code was identified at the time of analysis.