Junos authd: SNMP read access escalates to root code execution via a stack overflow

CVSS 8.7CVE-2026-101979Firmware, BMC & network fabriccurated

Impact

A specific SNMP packet overflows a stack buffer in authd and gives root code execution or a denial of service on devices where SNMP and AAA are both enabled. SNMP read community strings are widely distributed to monitoring systems and treated as low-value, so this converts a credential that most operators do not rotate carefully into full control of a fabric device. On a GPU cluster the monitoring collector that polls every leaf is exactly the host an attacker would use to reach all of them.

Who can reach it

A network attacker holding SNMP read access to the device, reachable on whatever interface SNMP listens on - typically the management VLAN. Requires SNMP and AAA configured.

What to do

Upgrade Junos OS / Junos OS Evolved per Juniper JSA112187 for the fixed releases; the upgrade reboots the device, so schedule per-switch windows. Short of that, restrict SNMP to the monitoring collectors with a client list and interface filter and rotate the community strings, which contains the exposure without a reboot.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-101979 https://supportportal.juniper.net/JSA112187

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.