CVE-2026-102068

Executive Summary

CVE-2026-102068 is a stack-based buffer overflow (CWE-121) in the kernel of Juniper Networks Junos OS Evolved. An unauthenticated, remote attacker can trigger a kernel panic by sending a crafted TCP packet when key-chain authentication is configured for BGP or LDP. The vulnerability carries a CVSS 3.1 base score of 7.5 (High), reflecting a network-reachable, low-complexity, no-privilege attack that fully compromises availability (A:H) with no impact to confidentiality or integrity. No public proof-of-concept, exploit code, or Nuclei template is currently available, and no patch has been released according to tracked sources.

Technical Analysis

The vulnerability is classified as CWE-121: Stack-based Buffer Overflow. Per the NVD description, the flaw resides in the kernel of Junos OS Evolved — not in a userspace routing daemon process. This distinction is operationally significant: a kernel-resident overflow affecting packet processing is reached through the platform's network stack rather than through a management interface or CLI.

The attack surface is defined by two conditions stated in the description:

1. Key-chain authentication must be in use for either the BGP or LDP protocol. Key-chain authentication is a Junos feature for managing rotating authentication keys (and associated algorithms) applied to routing protocol sessions. Its use for BGP or LDP implies TCP-based protocol sessions whose authentication material is processed by the platform.
2. The trigger is a crafted TCP packet. The description does not disclose which header field, option, or authentication-related payload element overflows the stack buffer, nor the size or structure of the malformed input. These specifics are not provided in the available data.

Because the vulnerable component is the kernel, the failure mode of a successful overflow is a kernel panic — a fatal, unrecoverable system fault that requires a device restart. The description explicitly frames the outcome as a panic rather than code execution, and the CVSS vector is consistent with this: Confidentiality and Integrity impacts are None, while Availability impact is High. This indicates an availability-only denial-of-service condition rather than a memory-corruption-to-RCE primitive.

Attack complexity is rated Low (AC:L) and no privileges (PR:N) or user interaction (UI:N) are required, meaning a single crafted packet sent from an unauthenticated network position can induce the fault. The "scope" metric is Unchanged (S:U), indicating the impact remains within the security authority of the vulnerable component.

Key unknowns that should not be fabricated: the precise kernel subsystem, the authentication processing routine, the exact packet field that overflows, and the required packet length/structure. What can be stated with confidence is the vulnerability class (stack buffer overflow), the trigger interface (TCP packets on BGP/LDP sessions with key-chain authentication), and the resulting condition (kernel panic).

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1) Reconnaissance / target identification. An attacker identifies a reachable Juniper device running Junos OS Evolved that participates in BGP (default TCP/179) or LDP (default TCP/646). The critical precondition is that key-chain authentication is configured for one of these protocols. Reachability of the BGP or LDP listener, and the presence of an authentication-enabled session, are the gating factors. Discovery can be performed via standard service scanning of TCP/179 and TCP/646.

2) Triggering the flaw class. The attacker establishes or interacts with a BGP/LDP TCP session context in which key-chain authentication is expected, then sends a crafted TCP packet. At the vulnerability-class level, a malformed input processed during authentication handling causes data to be written beyond the bounds of a fixed-size stack buffer in kernel space. The exact malformed element is not specified in the available advisory data; the report intentionally does not invent specific field names, functions, or payload structures.

3) Payload/execution method. The "payload" here is a single crafted packet (or small sequence) rather than a multi-stage exploit. Because the reported outcome is a kernel panic and there is no evidence of a code-execution primitive, the payload's purpose is to corrupt the stack in a way that forces a fatal kernel fault. No publicly documented packet template exists.

4) Post-exploitation impact. The primary effect is denial of service: the device panics and restarts, interrupting routing and all transit traffic handled by the platform. An attacker able to send the trigger repeatedly could induce a sustained restart loop, degrading network availability for the affected segment. There is no data indicating confidentiality or integrity compromise, lateral movement, or persistence gained through this flaw.

Impact Assessment

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5, High) breaks down as follows per the provided data:

• Attack Vector (N): exploitable over the network.
• Attack Complexity (L): no special conditions beyond the key-chain authentication configuration.
• Privileges Required (N): unauthenticated attacker.
• User Interaction (N): no user action required.
• Scope (U): impact confined to the vulnerable component.
• Confidentiality (N) / Integrity (N): no impact.
• Availability (H): total loss of availability for the affected component — consistent with a kernel panic.

Business impact: Devices running Junos OS Evolved that use key-chain authentication for BGP or LDP are at risk of attacker-triggered kernel panics. Because BGP and LDP are core routing protocols, a panic on a peering or edge device can cause route flapping, session resets, and traffic disruption across dependent networks. The unauthenticated and remotely triggerable nature (PR:N/AV:N) means an attacker needs only network reachability to the routing protocol listener, not credentials.

Blast radius: The immediate blast radius is the targeted device and any network segments that depend on its routing/Availability. Repetition of the attack extends the outage. The absence of a disclosed patch (0/4 patch confidence) and absence of a documented vendor workaround materially increase operational exposure for affected environments.

Detection Guidance

Sigma Rule

title: Potential CVE-2026-102068 Junos OS Evolved BGP/LDP Crafted TCP Kernel Panic Attempt
id: 3f7c9b21-8a4e-4d6f-9c2a-102068000001
status: experimental
description: Detects anomalous TCP activity toward BGP/LDP services on Junos OS Evolved devices that may correlate with CVE-2026-102068 kernel panic attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102068
author: valtersit.com
logsource:
  category: network_connection
  product: juniper
detection:
  selection_ports:
    dst_port:
      - 179
      - 646
  selection_action:
    action:
      - 'deny'
      - 'drop'
  condition: selection_ports and selection_action
falsepositives:
  - Legitimate BGP/LDP session resets
  - Network maintenance activity
level: medium

YARA Rule

rule CVE_2026_102068_Junos_Kernel_Panic_Artifacts
{
    meta:
        description = "Heuristic detection for host artifacts of CVE-2026-102068, a kernel stack buffer overflow triggering kernel panic on Junos OS Evolved"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102068"
        cve = "CVE-2026-102068"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "high"

    strings:
        $panic1 = "kernel panic" ascii nocase
        $panic2 = "stack overflow" ascii nocase
        $junos1 = "JUNOS" ascii
        $evolved = "Junos OS Evolved" ascii nocase
        $bgp = "BGP" ascii
        $ldp = "LDP" ascii
        $keychain = "key-chain" ascii nocase

    condition:
        ($panic1 or $panic2) and ($junos1 or $evolved) and ($bgp or $ldp or $keychain)
}

Suricata IDS Rule

alert tcp any any -> any 179 (msg:"CVE-2026-102068 Juniper Junos OS Evolved BGP crafted TCP packet kernel panic attempt"; flow:to_server,established; dsize:>0; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-dos; reference:cve,CVE-2026-102068; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102068; sid:1020680001; rev:1;)
alert tcp any any -> any 646 (msg:"CVE-2026-102068 Juniper Junos OS Evolved LDP crafted TCP packet kernel panic attempt"; flow:to_server,established; dsize:>0; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-dos; reference:cve,CVE-2026-102068; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102068; sid:1020680002; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [network where network.transport == "tcp" and destination.port in (179, 646)]
  [network where network.transport == "tcp" and destination.port in (179, 646) and event.outcome == "failure"]

Splunk SPL Query

index=network (dest_port=179 OR dest_port=646) sourcetype=juniper:firewall OR sourcetype=pan:traffic
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip dest_port
| where count > 10
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count
| table src_ip dest_ip dest_port count first_seen last_seen

Wazuh OSSEC Rule

<group name="juniper,junos,cve-2026-102068,">
  <rule id="102068" level="10">
    <decoded_as>json</decoded_as>
    <match>kernel panic|stack overflow|Junos OS Evolved</match>
    <description>CVE-2026-102068: Possible kernel panic on Junos OS Evolved device after crafted TCP packet affecting BGP/LDP key-chain authentication.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_102068,denial_of_service,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations. Because the flaw requires key-chain authentication to be in use for BGP or LDP, and no patch is available, the most direct exposure-reduction step is to evaluate whether key-chain authentication is actively configured for BGP/LDP on Junos OS Evolved devices. Where operationally feasible, review that configuration against alternative, still-supported authentication arrangements or restrict which peers can reach the BGP (TCP/179) and LDP (TCP/646) listeners. Apply infrastructure ACLs and firewall policy so that only trusted, expected peer addresses can initiate BGP/LDP sessions to the device, reducing the set of sources capable of delivering a crafted packet. Monitor routing sessions for unexpected resets or device reboots, which may indicate triggered panics.

2) Patch/upgrade steps. No patch or fixed version is identified in tracked sources, and no vendor fix is documented. Tracking advisories from Juniper Networks for an official fix is required; until a fixed release is published, do not assume any specific version resolves the issue. When a vendor advisory becomes available, follow Juniper's stated upgrade guidance for Junos OS Evolved and verify the fix against the affected release train.

3) Long-term hardening. Maintain disciplined exposure management for routing protocol listeners: default-deny inbound access to BGP/LDP from anything other than known peers at the network edge. Keep control-plane and management interfaces on isolated, access-controlled segments. Establish change tracking for authentication configuration (including key-chain usage), and monitor vendor security advisories for Junos OS Evolved on an ongoing basis. Build detection coverage for anomalous BGP/LDP session churn and unexpected device restarts so that availability-impacting events are detected quickly.

References

• NVD — CVE-2026-102068: https://nvd.nist.gov/vuln/detail/CVE-2026-102068
• CWE-121 — Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
• Juniper Networks Security Advisories: https://supportportal.juniper.net/s/global-search/%40uri#t=SecurityAdvisories
• FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-102068 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No exploit-in-the-wild evidence, threat actor campaign attribution, or public proof-of-concept is associated with CVE-2026-102068 in the provided data. CISA KEV status: NO.