CVE-2026-102045— Junos OS Evolved: An crafted LACP frame causes lacpd to crash when LACP is enabled
Quick assessment
Affected
Juniper Networks Junos OS Evolved
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Juniper Networks Junos OS Evolved 中的 lacpd 存在一个越界写入漏洞。该漏洞允许位于二层相邻位置的攻击者通过发送构造的帧（接收自启用了 LACP 的聚合以太网成员端口）来导致拒绝服务。
Affected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Juniper Networks | Junos OS Evolved | 24.4< 24.4R2-S5-EVO |
affected |
25.2< 25.2R2-S2-EVO |
affected | ||
25.4< 25.4R1-S3-EVO |
affected | ||
26.2< 26.2R1-S2-EVO |
affected | ||
25.2X100< 25.2X100-D35-EVO |
affected | ||
25.4X300< 25.4X300-D40-EVO |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102045
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Junos OS Evolved: An crafted LACP frame causes lacpd to crash when LACP is enabled
Source: CVE Program / CVE List V5
Vulnerability Description
An Out-of-bounds Write Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to cause a denial of service via a crafted frame received on an LACP-enabled aggregated-Ethernet member port.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Juniper Networks | Junos OS Evolved | 24.4 ~ 24.4R2-S5-EVO | - |
|
II. Public POCs for CVE-2026-102045
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102045
请登录查看更多情报信息。
Other References for CVE-2026-102045 (1)
-
Article Detail vendor-advisory
Same Patch Batch · Juniper Networks · 2026-10-14 · 153 CVEs total
| CVE-2026-101954 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover |
| CVE-2026-102175 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: An attacker causes remote code execution or denial of servi |
| CVE-2026-102178 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: When BGP update-threading is enabled a specifically malform |
| CVE-2026-102182 | 9.8 CRITICAL | Junos OS: MX Series: Certificate-based IKE packets cause root-level code execution |
| CVE-2026-102031 | 9.8 CRITICAL | Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authori |
| CVE-2026-33789 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a speci |
| CVE-2026-33792 | 9.8 CRITICAL | Junos OS: SRX Series: An attacker causes remote code execution and denial of service when |
| CVE-2026-33796 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP r |
| CVE-2026-101990 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re |
| CVE-2026-101950 | 9.8 CRITICAL | Junos OS: SRX Series: Malformed IPv4 packets cause packet-forwarding process crash when Se |
| CVE-2026-101986 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: J-Web permits pre-authentication CGI execution |
| CVE-2026-101956 | 9.8 CRITICAL | Junos OS: Unauthorized root command execution when J-Web is enabled |
| CVE-2026-101982 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: A EVPN peer causes an rpd crash or root-level compromise wh |
| CVE-2026-101983 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: An attacker causes remote code execution when J-Web virtual |
| CVE-2026-101980 | 9.8 CRITICAL | Junos OS: Malformed Extended Echo requests cause a Routing Engine reboot when Extended Ech |
| CVE-2026-102052 | 8.8 HIGH | Junos OS and Junos OS Evolved: An attacker causes jdhcpd to crash when the DHCPv4 local-cl |
| CVE-2026-102055 | 8.8 HIGH | Junos OS and Junos OS Evolved: MX Series, PTX Series: An attacker causes remote code execu |
| CVE-2026-101978 | 8.8 HIGH | Junos OS Evolved: PTX Series: An attacker controlled gRPC response causes root-level compr |
| CVE-2026-102174 | 8.8 HIGH | Junos OS: SRX Series: An authenticated remote-access VPN client causes iked denial of serv |
| CVE-2026-102050 | 8.8 HIGH | Junos OS and Junos OS Evolved: An adjacent attacker causes Layer 2 control-plane denial of |
Showing top 20 of 153 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Junos OS Evolved
-
CVE-2026-102031
Junos OS Evolved: A low-privileged TACACS+ user causes root -
CVE-2026-102023
Junos OS Evolved: An attacker causes denial of service via S -
CVE-2026-102012
Junos OS Evolved: An attacker causes na-grpcd to crash when -
CVE-2026-102085
Junos OS Evolved: A port which has been inadvertently expose -
CVE-2026-101965
Junos OS Evolved: An attacker causes telemetry disruption wh
Same vendor: Juniper Networks
-
CVE-2026-101954
Junos OS and Junos OS Evolved: Unauthenticated network acces -
CVE-2026-101952
Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update -
CVE-2026-101949
Junos OS and Junos OS Evolved: In a scenario with VPN-flowsp -
CVE-2026-101964
Junos OS and Junos OS Evolved: An attacker can cause an rpd -
CVE-2026-101963
Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an
Same weakness: CWE-787
-
CVE-2026-79841
HPE NonStop RDMA SERVICES NSK - Out-of-bounds memory write v -
CVE-2026-58098
Heap out-of-bounds access in semop(2) -
CVE-2026-110839
FreeRDP 3.3.0 before 3.32.0 Heap Out-of-Bounds Write via Gra -
CVE-2026-110698
Praat Model Loader whisper.cpp whisper_model_load out-of-bou -
CVE-2026-86849
Dpdk: dpdk: integer overflow combined with missing validatio
V. Comments for CVE-2026-102045
No comments yet