Junos OS EUVD-2026-101379

Exploitation requires the device to have enhanced CFM mode enabled AND a down-MEP (Maintenance association End Point) configured - this is not a default configuration, so devices not running CFM/802.1ag Ethernet OAM are not affected. The attacker must be positioned on an adjacent Layer 2 network able to deliver CFM frames to the configured MEP (AV:A), but needs no authentication (PR:N) and no user interaction (UI:N). Only MX Series (Junos OS) and PTX Series (Junos OS Evolved) platforms are in scope; other Junos platforms are not listed as affected. The non-default CFM configuration and the adjacent-network positioning requirement are the primary limiting factors defenders can rely on.

This is a genuine high-priority vulnerability, though its real-world exposure is gated by configuration. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 8.7) describes an unauthenticated, low-complexity attack from an adjacent network yielding full code execution as root - the maximum technical impact. These signals are internally consistent: CFM (Connectivity Fault Management, IEEE 802.1ag Ethernet OAM) is a Layer 2 protocol, which correctly justifies AV:A (adjacent) rather than AV:N, because the attacker must be able to send frames to the device's CFM maintenance endpoint rather than route packets to it from the internet. No EPSS score, CISA KEV listing, or public POC is present in the input, so there is currently no evidence of active exploitation or weaponization - the elevated risk is driven by impact and ease of attack, not by observed exploitation. The practical risk is substantially reduced by the requirement that enhanced CFM mode be enabled and a down-MEP be configured, which is not a default state. Net assessment: a serious flaw warranting prompt patching on affected MX/PTX devices that run CFM, but not a mass-exploitation emergency absent KEV/EPSS signals.

An attacker with access to an adjacent Layer 2 segment that reaches a Juniper MX or PTX device configured with enhanced CFM mode and a down-MEP sends a specially crafted CFM (802.1ag) message. The malformed message overflows a stack buffer in the cfmd process, letting the attacker either crash cfmd for a denial of service or execute arbitrary code with root privileges. No public exploit code is identified at time of analysis, so exploitation would require the attacker to develop the overflow payload independently.