Junos OS (SRX firewalls)
CVE-2026-102084: SRX Series: In an ADVPN scenario a malformed message from a peer causes Remote Code Execution
An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker to take complete control of the device.
Published Juniper Networks advisory JSA112173
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (SRX Series) 0 | 23.2R2-S7.7 or later |
| Junos OS (SRX Series) 23.4 | 23.4R2-S7 or later |
| Junos OS (SRX Series) 24.2 | 24.2R2-S4 or later |
| Junos OS (SRX Series) 24.4 | 24.4R2-S3 or later |
| Junos OS (SRX Series) 25.2 | 25.2R2 or later |
| Junos OS (SRX Series) 25.4 | 25.4R1-S3 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
A flaw in the VPN daemon of Junos OS on SRX firewalls allows an attacker to send specifically malformed attributes via AutoDiscovery VPN, causing a buffer overflow that leads to remote code execution and complete device control. The attacker must operate over the network without user interaction but requires the shared secret to impersonate a peer or must have already compromised an existing peer.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker to take complete control of the device.
If an SRX device configured for AutoDiscovery VPN (ADVPN) receives a message from a peer that contains one or more specifically malformed attributes, this will cause a buffer overflow, which can allow remote code execution and therefore allow an attacker to take complete control of the device. To be able to carry out this attack an attacker must either have acquired the shared secret to impersonate a peer or have compromised an existing one, so this attack is considerably difficult.
This issue affects Junos OS on SRX Series:
- All versions before 23.2R2-S7.7;
- from 23.4 before 23.4R2-S7;
- from 24.2 before 24.2R2-S4;
- from 24.4 before 24.4R2-S3;
- from 25.2 before 25.2R2;
- from 25.4 before 25.4R1-S3.
Am I affected?
To be exposed to this issue ADVPN needs to be configured:
[ security ike gateway <gateway> advpn ... ]
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.