#NØØT_Security_Alerts 🚨 #ALERT — JUNIPER SECURE-ZTP: UNAUTHENTICATED DHCP BUFFER OVERFLOW CAN ENABLE ROOT-LEVEL CODE EXECUTION October 14, 2026 DISCLOSED BY: Juniper Networks SIRT PRODUCT: Junos OS / Junos OS Evolved COMPONENT: Phone-home daemon (phcd) CVE: CVE-2026-102061 SEVERITY: HIGH — CVSS 3.1: 8.8 / CVSS 4.0: 8.7 WEAKNESS: CWE-121 — Stack-Based Buffer Overflow AFFECTED VERSIONS: Vulnerable Junos OS and Junos OS Evolved releases preceding branch-specific October 2026 security fixes. Junos OS fixes include: 23.2R2-S7.7 / 23.4R2-S8.13 / 24.2R2-S5.5 / 24.4R2-S5 / 25.2R2-S2 / 25.4R1-S3 / 26.2R1-S2. Evolved platforms require their corresponding EVO fixes, including applicable X-series releases. IMPACT: A crafted DHCP Secure Zero Touch Provisioning (SZTP) bootstrap message can trigger a stack-based buffer overflow in phcd. Successful exploitation could allow arbitrary code execution with root privileges. EXPOSURE: Requires adjacent network access and a vulnerable platform supporting Secure-ZTP. This is NOT a general internet-exposed unauthenticated RCE. EXPLOITATION STATUS: VENDOR-CONFIRMED ROOT-LEVEL RCE VULNERABILITY. Juniper reports no known malicious exploitation. No independently verified public working exploit established. Forensic triage: Identify devices supporting Secure-ZTP. Review DHCP provisioning traffic and unexpected bootstrap activity. Investigate abnormal phcd behavior, suspicious configuration changes and unauthorized privileged execution. No confirmed CVE-specific attacker infrastructure or malicious hashes published. URGENT ACTION: Deploy the applicable Junos OS or Junos OS Evolved security update. Restrict rogue DHCP infrastructure. Review provisioning-network segmentation and authorized bootstrap services. Juniper reports no known workaround. SOURCE: https://supportportal.juniper.net/JSA112187 OFFICIAL CVE: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102061.json CONFIDENCE: HIGH — Juniper-authored CVE record confirms the vulnerability, Secure-ZTP prerequisite, root-level impact and fixed releases. ACTIVE EXPLOITATION: NOT VERIFIED. #CyberSecurity #ThreatIntel #Juniper #SecureZTP #RCE #NetworkSecurity