Description
An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker to take complete control of the device.

If an SRX device configured for AutoDiscovery VPN (ADVPN) receives a message from a peer that contains one or more specifically malformed attributes, this will cause a buffer overflow, which can allow remote code execution and therefore allow an attacker to take complete control of the device. To be able to carry out this attack an attacker must either have acquired the shared secret to impersonate a peer or have compromised an existing one, so this attack is considerably difficult.

This issue affects Junos OS on SRX Series:


* All versions before 23.2R2-S7.7;
* from 23.4 before 23.4R2-S7;
* from 24.2 before 24.2R2-S4;
* from 24.4 before 24.4R2-S3;
* from 25.2 before 25.2R2;
* from 25.4 before 25.4R1-S3.
Published: 2026-10-14
Score: 9.2 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

In an AutoDiscovery VPN configuration, a network‑based attacker who has obtained or compromised the shared secret can send a specially crafted message containing malformed attributes. Junos OS’s VPN daemon fails to verify syntactic correctness of the input, leading to a buffer overflow that enables arbitrary code execution and full device takeover. This flaw requires authentication over the network, but once achieved, the attacker gains complete control of the SRX device.

Affected Systems

The vulnerability affects Juniper Networks Junos OS running on SRX Series routers. All releases prior to 23.2R2-S7.7, 23.4R2-S7, 24.2R2-S4, 24.4R2-S3, 25.2R2, and 25.4R1-S3 are impacted. The vendor lists fixes in releases 23.2R2-S7.7, 23.4R2-S7, 24.2R2-S4, 24.4R2-S3, 25.2R2, 25.4R1-S3, 26.2R1, and all subsequent Junos OS versions.

Risk and Exploitability

The CVSS score of 9.2 indicates a critical impact. The EPSS score of < 1% indicates a very low probability of exploitation, but the vulnerability is not listed in the CISA KEV catalog. Given the need for a valid shared secret, the attack vector is network‑based but requires attacker credentials or compromise of an existing peer. While the exploitation conditions are stringent, the potential loss of full device control makes the risk high. No official workaround is available, so the only mitigating action is to apply a patched firmware release.

Generated by OpenCVE AI on October 15, 2026 at 17:15 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS: 23.2R2-S7.7, 23.4R2-S7, 24.2R2-S4, 24.4R2-S3, 25.2R2, 25.4R1-S3, 26.2R1, and all subsequent releases. Note: For Junos OS release 23.2, a specific respin has been referenced. Previously published versions of this release have been rebuilt to resolve the security vulnerabilities identified in this advisory.

Vendor Workaround

There are no known workarounds for this issue.

OpenCVE Recommended Actions

  • Upgrade the SRX device to any Junos OS release listed by Juniper that includes the fix (23.2R2-S7.7, 23.4R2-S7, 24.2R2-S4, 24.4R2-S3, 25.2R2, 25.4R1-S3, 26.2R1, or later).
  • Restart the device after the firmware upgrade to ensure the new code is in use.
  • Continuously monitor SRX logs for anomalous ADVPN traffic and, if necessary, restrict or block unexpected VPN peers while a patch is applied.

Generated by OpenCVE AI on October 15, 2026 at 17:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Juniper Networks
Juniper Networks junos Os
Vendors & Products Juniper Networks
Juniper Networks junos Os

Thu, 15 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker to take complete control of the device. If an SRX device configured for AutoDiscovery VPN (ADVPN) receives a message from a peer that contains one or more specifically malformed attributes, this will cause a buffer overflow, which can allow remote code execution and therefore allow an attacker to take complete control of the device. To be able to carry out this attack an attacker must either have acquired the shared secret to impersonate a peer or have compromised an existing one, so this attack is considerably difficult. This issue affects Junos OS on SRX Series: * All versions before 23.2R2-S7.7; * from 23.4 before 23.4R2-S7; * from 24.2 before 24.2R2-S4; * from 24.4 before 24.4R2-S3; * from 25.2 before 25.2R2; * from 25.4 before 25.4R1-S3.
Title Junos OS: SRX Series: In an ADVPN scenario a malformed message from a peer causes Remote Code Execution
Weaknesses CWE-1286
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:N/R:U/RE:M'}

Subscriptions

Juniper Networks Junos Os
cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-10-15T03:57:23.677Z

Reserved: 2026-09-28T17:37:38.548Z

Link: CVE-2026-102084

cve-icon Vulnrichment

Updated: 2026-10-14T20:39:28.662Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T17:18:04.310

Modified: 2026-10-15T16:24:19.073

Link: CVE-2026-102084

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T01:00:13Z

Weaknesses
  • CWE-1286

    Improper Validation of Syntactic Correctness of Input