Junos OS CVE-2026-102176

Exploitation requires BOTH the SDK service process to be running AND a JDAF (Juniper Device Application Framework) routing instance to be enabled on the Junos OS device - this is a non-default configuration, so devices without this feature combination are not affected. The attacker must be on an adjacent network segment (CVSS AV:A), not arbitrary remote internet reach, which limits exposure to on-link or same-broadcast-domain positions. No authentication is required (PR:N) and no user interaction is needed (UI:N), and attack complexity is low (AC:L), so for an adjacent attacker against a feature-enabled device exploitation is straightforward. Affected versions include Junos OS before 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, and 26.2R1-S2; upgrading to the fixed releases removes the condition.

This is a credible but condition-gated priority. The supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) scores 8.7 (High) and indicates an unauthenticated attacker with low complexity and no user interaction, yielding high confidentiality, integrity and availability impact (VC:H/VI:H/VA:H) consistent with full Routing Engine compromise. Crucially the vector is AV:A (Adjacent), NOT AV:N (Network), so exploitation requires the attacker to be on the same logical/physical adjacent segment rather than arbitrary internet-wide reach - this meaningfully narrows real-world exposure versus a true remote-network flaw. Exploitation is further gated on a non-default feature combination (SDK service plus a JDAF routing instance enabled), so only a subset of deployed Junos devices are actually vulnerable. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a vendor-confirmed, patched, high-severity RE-compromise/DoS issue that warrants prompt patching on affected versions where the feature is enabled, but it is not an internet-facing mass-exploitation scenario given the adjacent vector and the required non-default configuration.

An attacker positioned on a network segment adjacent to a vulnerable Junos OS device (where the SDK service and a JDAF routing instance are enabled) sends specially crafted packets to the SDK service process, overflowing a fixed-size buffer. This either crashes the service to cause a denial of service or corrupts memory to compromise the Routing Engine. No public exploit code was provided in the intelligence; low attack complexity (AC:L) and no required authentication or user interaction make exploitation straightforward for an on-segment attacker.