Unauthenticated RCE in Juniper MX IKE via Stack Buffer Overflow
A stack-based buffer overflow in the kmd component allows remote attackers to execute code as root on affected Junos OS versions.
Key points
- CVE-2026-102182 carries a CVSS score of 9.8, rated critical severity by the National Vulnerability Database.
- The flaw resides in the kmd component and is triggered by specific IKE certificate-based packets.
- Multiple Junos OS release lines for MX Series routers are affected, including versions prior to 21.2R3-S11.
Juniper Networks MX Series routers running Junos OS contain a critical stack-based buffer overflow vulnerability. An unauthenticated network attacker can exploit this flaw in the kmd component to execute arbitrary code with root privileges.
What happened
The National Vulnerability Database records CVE-2026-102182 as a critical issue with a CVSS score of 9.8. The vulnerability is classified under CWE-121, indicating a stack-based buffer overflow. This flaw exists within the kmd component of Juniper Networks Junos OS specifically on MX Series hardware.
An attacker does not need authentication to exploit this issue. By sending specific Internet Key Exchange (IKE) packets that use certificates, a remote adversary can trigger the overflow. Successful exploitation allows the attacker to execute code as the root user on the affected system.
This issue affects a wide range of Junos OS versions. It impacts all versions before 21.2R3-S11 and versions from 21.4 before 21.4R3-S12. It also affects versions from 22.2 before 22.2R3-S8, from 22.3 before 22.3R3-S5, and from 22.4 before 22.4R3-S9.
Further affected versions include those before 23.2R2-S7.7, before 23.4R2-S8.13, before 24.2R2-S5.5, and before 24.4R2-S5. The NVD record lists these specific version boundaries for MX Series devices.
Why it matters
Root-level code execution on a network router can compromise the entire infrastructure. The kmd component is the target of this stack-based buffer overflow. The unauthenticated nature of the exploit means any internet-facing MX router is at risk.
The broad range of affected versions indicates that many organizations may still be running vulnerable software. Even recent maintenance releases prior to the specified boundaries are susceptible. This increases the attack surface for enterprises relying on Juniper MX Series for edge connectivity.
What to watch
- Verify your current Junos OS version against the affected lists provided by Juniper.
- Monitor for unusual IKE traffic patterns or certificate validation errors in logs.
- Check for unexpected process spawns or privilege escalations on router consoles.
Signals worth monitoring
Security teams should review firewall and router logs for anomalous IKE negotiation failures. Look for spikes in certificate-based packet processing that do not result in successful connections. Monitor system resources for sudden increases in CPU or memory usage during IKE exchanges. Check for new user accounts or modified configuration files that appear without administrative action. Isolate affected devices from the network if suspicious activity is confirmed. Review access control lists to restrict IKE traffic to known peers only.
Background: CVSS score
CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.
Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment
What to do and how to stay safe: Juniper Networks
- Audit all MX Series routers to identify those running vulnerable Junos OS versions.
- Restrict inbound IKE traffic to trusted IP addresses using access control lists.
- Enable detailed logging for IKE certificate validation events to detect exploitation attempts.
- Plan to upgrade to a patched version once the vendor provides an update.
General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which CVE ID corresponds to this Juniper MX vulnerability?
The vulnerability is tracked as CVE-2026-102182 in the National Vulnerability Database.
What is the CVSS score for this stack-based buffer overflow?
The NVD assigns a CVSS score of 9.8, rating the severity as critical.
Can an attacker exploit this flaw without credentials?
Yes, the vulnerability allows an unauthenticated network attacker to execute code as root.
