Junos OS (SRX firewalls)
CVE-2026-102182: MX Series: Certificate-based IKE packets cause root-level code execution
A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.
Published Juniper Networks advisory JSA112196
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (MX Series) 0 | 23.2R2-S7.7 or later |
| Junos OS (MX Series) 23.4 | 23.4R2-S8.13 or later |
| Junos OS (MX Series) 24.2 | 24.2R2-S5.5 or later |
| Junos OS (MX Series) 24.4 | 24.4R2-S5 or later |
| Junos OS (MX Series) 25.2 | 25.2R2-S2 or later |
| Junos OS (MX Series) 25.4 | 25.4R1-S3 or later |
| Junos OS (MX Series) 26.2 | 26.2R1-S2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
The kmd component in Junos OS on MX Series devices contains a stack-based buffer overflow flaw. An unauthenticated attacker can exploit this vulnerability by sending specific IKE certificate-based packets over the network. This allows the attacker to execute arbitrary code with root privileges, requiring no prior login or user interaction.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.
This issue affects Junos OS on MX Series:
- All versions before 21.2R3-S11;
- from 21.4 before 21.4R3-S12;
- from 22.2 before 22.2R3-S8;
- from 22.3 before 22.3R3-S5;
- from 22.4 before 22.4R3-S9;
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.