CVE-2026-102084
8.1HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-1286
Impact
An attacker can achieve remote code execution and take complete control of the SRX device. To trigger this, they must be a network-based peer with access to the VPN shared secret or compromise an existing ADVPN peer.
Root cause
The VPN daemon fails to validate the syntax of malformed attributes received from an ADVPN peer, leading to a buffer overflow.
Affected systems
Juniper Junos OS on SRX Series: all versions before 23.2R2-S7.7; 23.4 before 23.4R2-S7; 24.2 before 24.2R2-S4; 24.4 before 24.4R2-S3; 25.2 before 25.2R2; and 25.4 before 25.4R1-S3.
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Junos OS to 23.2R2-S7.7, 23.4R2-S7, 24.2R2-S4, 24.4R2-S3, 25.2R2, 25.4R1-S3, or later. If patching immediately is not possible, disable AutoDiscovery VPN (ADVPN) configurations on the SRX series devices.
$ show versionAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker to take complete control of the device. If an SRX device configured for AutoDiscovery VPN (ADVPN) receives a message from a peer that contains one or more specifically malformed attributes, this will cause a buffer overflow, which can allow remote code execution and therefore allow an attacker to take complete control of the device. To be able to carry out this attack an attacker must either have acquired the shared secret to impersonate a peer or have compromised an existing one, so this attack is considerably difficult. This issue affects Junos OS on SRX Series: * All versions before 23.2R2-S7.7; * from 23.4 before 23.4R2-S7; * from 24.2 before 24.2R2-S4; * from 24.4 before 24.4R2-S3; * from 25.2 before 25.2R2; * from 25.4 before 25.4R1-S3.