CVE-2026-102182
9.8CriticalPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-121
Impact
Unauthenticated attackers can execute arbitrary code as root on the device by sending crafted IKE certificate packets over the network. They only need network reachability to the IKE service on an affected interface.
Root cause
A stack-based buffer overflow in the kmd process improperly handles incoming IKE certificate-based packets.
Affected systems
Juniper Networks Junos OS on MX Series: all versions before 21.2R3-S11, 21.4 before 21.4R3-S12, 22.2 before 22.2R3-S8, 22.3 before 22.3R3-S5, and 22.4 before 22.4R3-S9.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to Junos OS 21.2R3-S11, 21.4R3-S12, 22.2R3-S8, 22.3R3-S5, 22.4R3-S9, or later releases. If patching immediately is not possible, restrict untrusted network access to IKE ports (UDP 500 and UDP 4500) via firewall filters or disable certificate-based IKE negotiation where feasible.
$ show versionAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. This issue affects Junos OS on MX Series: * All versions before 21.2R3-S11; * from 21.4 before 21.4R3-S12; * from 22.2 before 22.2R3-S8; * from 22.3 before 22.3R3-S5; * from 22.4 before 22.4R3-S9;