CVE-2026-101973 in Junos OS
Summary
by MITRE • 10/15/2026
A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during CMP enrollment or automatic certificate re-enrollment.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The identified security flaw resides within the Public Key Infrastructure Daemon, commonly referred to as pkid, which is a critical component of the Juniper Networks Junos operating system responsible for managing cryptographic keys and certificates. This specific vulnerability manifests as a NULL pointer dereference, a classic memory management error where software attempts to access a memory location that has not been allocated or initialized. In this context, the flaw is triggered during the Certificate Management Protocol enrollment process or when an automatic certificate re-enrollment occurs. The operational mechanism involves the pkid component failing to properly validate input parameters derived from incoming network packets before attempting to dereference them as valid pointers within its internal data structures.
An unauthenticated remote attacker can exploit this condition by crafting and transmitting a specifically malformed packet designed to trigger the erroneous code path during the enrollment handshake or re-enrollment sequence. Because the vulnerability allows for exploitation without prior authentication, it presents a significant risk vector against systems that have not implemented strict access controls on the management interfaces or certificate services ports. The immediate consequence of this exploit is a denial of service condition affecting the pkid process itself. When the NULL pointer dereference occurs, the operating system typically terminates the offending application to prevent further memory corruption, leading to an abrupt crash of the Certificate Management Daemon.
The impact of this disruption extends beyond the mere termination of a single background process. Since pkid is integral to the device's ability to maintain secure communications and validate identities via digital certificates, its failure can disrupt ongoing TLS sessions, break VPN tunnels that rely on certificate-based authentication, and prevent new connections from being established securely. This effectively degrades the network security posture of the affected Juniper device, potentially leaving it unable to participate in secured infrastructure operations until the service is manually restarted or the system is rebooted. The availability impact is severe as it allows an external actor to disrupt critical security services without needing valid credentials.
From a classification perspective, this vulnerability aligns with CWE-476, which defines NULL Pointer Dereference, indicating that the root cause lies in improper handling of null values during pointer operations. In terms of offensive cyber tactics, this exploit maps to MITRE ATT&CK technique T1499, specifically Endpoint Denial of Service via application exhaustion or crash, as well as potentially T1078 if it were used to disrupt authentication mechanisms generally. The attack vector is classified as Network with Low Complexity and requires no user interaction, making it a high-severity remote exploit.
To mitigate this risk, organizations running affected versions of Junos OS must apply the vendor-provided security patches that address the input validation logic within the pkid component. Until patching can be performed, network administrators should consider implementing strict firewall rules to restrict access to the ports used by Certificate Management Protocol and related enrollment services to only trusted management subnets or specific IP addresses known for legitimate certificate operations. Additionally, enabling logging on these interfaces can aid in detecting attempts to send malformed packets that trigger this vulnerability, allowing for rapid incident response before a successful denial of service event occurs. Regularly updating the Junos OS is the most effective long-term strategy to ensure such memory safety issues are resolved and do not persist as attack vectors against network infrastructure.