Junos eventd: heap overflow in IPC event messages gives a local unprivileged user root on the device

CVSS 8.6CVE-2026-101927Firmware, BMC & network fabriccurated

Impact

Any unprivileged local account on a Junos device can send crafted IPC event messages to eventd and either crash it or escalate to root. Root on a fabric switch is total: the attacker can rewrite forwarding and VXLAN state, mirror tenant traffic between GPU nodes, install persistence that survives a config rollback, and use the box as a foothold on the management VLAN. This affects all platforms, not a single series, so it covers the datacenter leaves and spines as well as edge routers. The practical question is who holds a shell on the switch - NOC operators, automation service accounts, and anything that lands a low-privilege login all qualify.

Who can reach it

Local unprivileged user on the Junos device - any shell or low-privilege login on the switch, including an automation account. No network reach to the device's data plane is needed.

What to do

Upgrade to a Junos OS / Junos OS Evolved release fixed per JSA112187; the upgrade reloads the routing engine, so it is a per-device reboot window. Because the attack requires a local account, the interim control is account hygiene: audit who and what has login on fabric devices, pull shared automation credentials back to least privilege, and keep device management off any network a tenant can reach. This record does not state fixed versions - take them from the advisory.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-101927 https://supportportal.juniper.net/JSA112187

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.