CVE-2026-102175: A Pre-Authentication Heap Overflow in Junos sdxd Puts Root Code Execution Behind a Service-Deployment Link

Juniper's October 2026 security bulletin covers nine critical Junos OS and Junos OS Evolved vulnerabilities, and most of them assume the attacker already has a foothold in the control plane or the management plane. CVE-2026-102175 is the exception worth reading twice. It sits in the service-deployment daemon, needs no credentials, and ends in root code execution or a denial of service on the routing engine itself.

Vulnerability overview

CVE-2026-102175 is a heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved. NVD records a CVSS v3.1 base score of 9.8 and a CVSS v4.0 base score of 9.3, both critical, with the v3.1 vector describing a network-reachable, low-complexity, unauthenticated attack that compromises confidentiality, integrity and availability.…