Description
A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.

This issue requires IKE to be enabled with an RSA-signature IKE policy to be vulnerable.

This issue affects Junos OS on MX Series:


* All versions before 21.2R3-S11;
* from 21.4 before 21.4R3-S12;
* from 22.2 before 22.2R3-S8;
* from 22.3 before 22.3R3-S5;
* from 22.4 before 22.4R3-S9;
Published: 2026-10-14
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Root‑level code execution via unauthenticated IKE certificate packets
Action: Immediate Patch
AI Analysis

Impact

A stack‑based buffer overflow exists in the kmd component of Juniper Networks Junos OS on MX Series routers. The flaw allows an unauthenticated attacker to deliver specially crafted IKE certificate‑based packets that overflow a buffer and execute arbitrary code with root privileges, providing full control of the device. This vulnerability is triggered only when IKE is enabled with an RSA‑signature IKE policy. The vulnerability is classified as CWE‑121.

Affected Systems

All Junos OS releases on MX Series devices prior to 21.2R3‑S11, 21.4R3‑S12, 22.2R3‑S8, 22.3R3‑S5, and 22.4R3‑S9 are affected. The vendor has released patch updates starting with 23.2R2‑S7.7 and continuing through 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all subsequent releases. Devices running any of the affected versions should be upgraded to one of these patched releases.

Risk and Exploitability

The CVSS score of 9.3 and the EPSS score of less than 1% indicate a critical severity but a very low probability of exploitation in the current threat landscape. The flaw can be triggered over the network by an unauthenticated attacker sending crafted IKE certificate packets, which does not require valid authentication. Because the vulnerability provides root‑level execution, it poses a high risk of full system compromise. The issue is not listed in CISA’s KEV catalog at this time.

Generated by OpenCVE AI on October 22, 2026 at 23:12 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases. Note: For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

Vendor Workaround

There are no known workarounds for this issue.

OpenCVE Recommended Actions

  • Upgrade Junos OS on MX Series devices to the latest patched release (e.g., 23.2R2‑S7.7 or later) using Juniper's official update repositories
  • If the upgrade cannot be performed immediately, restrict inbound IKE certificate traffic to trusted IP ranges by configuring ACLs or firewall rules to reduce exposure
  • Revoke any unused or legacy IKE certificates and ensure only current, valid certificates are permitted on the device

Generated by OpenCVE AI on October 22, 2026 at 23:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. This issue affects Junos OS on MX Series: * All versions before 21.2R3-S11; * from 21.4 before 21.4R3-S12; * from 22.2 before 22.2R3-S8; * from 22.3 before 22.3R3-S5; * from 22.4 before 22.4R3-S9; A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. This issue requires IKE to be enabled with an RSA-signature IKE policy to be vulnerable. This issue affects Junos OS on MX Series: * All versions before 21.2R3-S11; * from 21.4 before 21.4R3-S12; * from 22.2 before 22.2R3-S8; * from 22.3 before 22.3R3-S5; * from 22.4 before 22.4R3-S9;

Sat, 17 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Juniper Networks
Juniper Networks junos Os
Vendors & Products Juniper Networks
Juniper Networks junos Os

Wed, 14 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. This issue affects Junos OS on MX Series: * All versions before 21.2R3-S11; * from 21.4 before 21.4R3-S12; * from 22.2 before 22.2R3-S8; * from 22.3 before 22.3R3-S5; * from 22.4 before 22.4R3-S9;
Title Junos OS: MX Series: Certificate-based IKE packets cause root-level code execution
Weaknesses CWE-121
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M'}

Subscriptions

Juniper Networks Junos Os
cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-10-20T20:30:29.536Z

Reserved: 2026-09-28T18:17:13.470Z

Link: CVE-2026-102182

cve-icon Vulnrichment

Updated: 2026-10-14T19:04:23.289Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T17:18:06.080

Modified: 2026-10-20T21:17:14.650

Link: CVE-2026-102182

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T23:15:13Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow