CVE-2026-102035 in Junos OS
Summary
by MITRE • 10/15/2026
A Reachable Assertion vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP peer message when MC-LAG IRB MAC synchronization is enabled.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The identified vulnerability resides within the Layer 2 Adjacency Lookup Daemon, known as l2ald, in Juniper Networks Junos OS and Junos OS Evolved operating systems. This component plays a critical role in maintaining adjacency information for data plane forwarding decisions, particularly in complex multi-chassis link aggregation configurations. The specific flaw is classified as a reachable assertion failure, which indicates that under certain conditions, the software encounters an internal state inconsistency or logical error that triggers a defensive code path designed to halt execution and generate a core dump rather than handling the anomaly gracefully. This type of vulnerability typically arises when input validation or state machine logic fails to account for edge cases in protocol message processing, leading to a crash of the affected process.
The attack vector requires an adjacent attacker who has network connectivity to the vulnerable device, specifically targeting the Intermediate System-to-Intermediate System (IS-IS) or similar control plane protocols that facilitate communication between peers. The exploitation condition is highly specific: it necessitates that Multi-Chassis Link Aggregation Group with Integrated Routing and Bridging MAC synchronization be enabled on the target system. In this configuration, two physical devices operate as a single logical entity to provide redundancy and increased bandwidth. When an attacker sends a crafted ICCP (Inter-Cluster Communication Protocol) peer message, or triggers specific state transitions within the MC-LAG framework, it induces the assertion failure in l2ald. Because the vulnerability is triggered by network traffic from an adjacent host, no authentication is required for exploitation if the attacker can reach the management or data plane interfaces involved in this synchronization process.
The operational impact of successfully exploiting this reachable assertion is a denial of service against the Junos OS instance. When the l2ald process crashes due to the failed assertion, it often leads to a restart of the daemon itself. In many Juniper implementations, critical control plane daemons are monitored by a watchdog mechanism; if such a daemon fails repeatedly or causes instability in adjacent processes like the Routing Engine, it can trigger a full system reboot. This results in significant network disruption, as all sessions dependent on that device will be dropped, and routing adjacencies must be re-established upon recovery. For environments relying on MC-LAG for high availability, this crash may also cause traffic blackholing or suboptimal path selection during the restart period, potentially affecting service level agreements and business continuity.
From a classification perspective, this vulnerability aligns with CWE-617: Reachable Assertion, which describes situations where an assertion condition can be met by external input, leading to program termination. It also relates to CWE-20: Improper Input Validation, as the root cause is likely insufficient checking of ICCP message parameters or state transitions before processing them within the l2ald logic. In terms of the MITRE ATT&CK framework, this falls under T1499: Endpoint Denial of Service, specifically leveraging service exhaustion through application crashes rather than resource consumption attacks like DDoS flooding. The attack is categorized as a local network-based denial of service with low complexity due to the specific configuration requirement but high impact on availability.
Mitigation strategies should focus primarily on applying vendor-provided software patches that address the assertion failure in l2ald and correct the underlying input validation logic. Administrators must ensure their Junos OS or Junos Evolved installations are updated to versions where this issue is resolved. In environments where immediate patching is not feasible, network segmentation can be employed to restrict access to the control plane interfaces from untrusted adjacent hosts. Additionally, reviewing MC-LAG configurations may reveal opportunities to disable MAC synchronization if it is not strictly required for the specific use case, thereby reducing the attack surface. Monitoring logs for l2ald restarts or core dumps can also serve as an early warning indicator of attempted exploitation attempts.