Junos OS: NULL dereference in pkid during CMP enrollment is a remote denial of service

CVSS 8.7CVE-2026-101973Firmware, BMC & network fabriccurated

Impact

A malformed packet received during CMP certificate enrollment or automatic re-enrollment dereferences a NULL pointer in pkid, the Junos PKI daemon. Losing pkid stops certificate enrollment and renewal on the device, which over time breaks anything that depends on those certificates - IPsec tunnels between sites, authenticated control-plane sessions. On a fabric where the GPU cluster reaches storage or other sites over certificate-authenticated tunnels, a device that cannot renew is a scheduled outage waiting to happen rather than an instant one. No authentication is required.

Who can reach it

Network, unauthenticated. An attacker who can respond to or inject into the device's CMP enrollment exchange - that is, anyone positioned between the device and its CA, or able to reach the enrollment path.

What to do

Upgrade to a Junos release listed as fixed in Juniper advisory JSA112188; fixed versions are not in the record, so read the advisory for your train. Junos upgrades mean a device reboot. In the interim, restrict reachability of the CA path and the enrollment interface to the management network.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-101973 https://supportportal.juniper.net/JSA112188

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.