CVE-2026-101994: Junos OS and Junos OS Evolved: Malformed MC-LAG ICCP message causes l2ald heap disclosure or crash

High severity · published Oct 14, 2026

CVE-2026-101994

Junos OS and Junos OS Evolved: Malformed MC-LAG ICCP message causes l2ald heap disclosure or crash

7.1

CVSS

0.3%

EPSS

On KEV

Description

An Improper Handling of Length Parameter Inconsistency vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who can control or impersonate a configured MC-LAG ICCP peer to disclose process heap memory or cause a denial of service via a malformed ICCP message.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Attack vector

Adjacent

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

Low

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 20% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Junos OS · Juniper

before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more · source: vendor

Junos OS Evolved · Juniper Networks

before 23.2R2-S7.7-EVO; 23.4 before 23.4R2-S8.11-EVO; 24.2 before 24.2R2-S5.6-EVO; 24.4 before 24.4R2-S5-EVO; 25.2 before 25.2R2-S2-EVO; 25.4 before 25.4R1-S3-EVO; +4 more · source: vendor

Affected product

Junos OS

Juniper

All Junos OS CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-101994

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-101994

vendor-advisory

https://supportportal.juniper.net/JSA112187