CVE-2026-102182— Junos OS: MX Series: Certificate-based IKE packets cause root-level code execution
Quick assessment
Affected
Juniper Networks Junos OS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Juniper Networks Junos OS 在 MX 系列设备上的 kmd 组件中存在栈缓冲区溢出漏洞。未经身份验证的网络攻击者可以通过特定的 IKE 基于证书的包，以 root 权限执行代码。 该问题影响以下 Junos OS 版本（MX 系列）： 21.2R3-S11 之前的所有版本； 21.4 系列中，早于 21.4R3-S12 的版本； 22.2 系列中，早于 22.2R3-S8 的版本； 22.3 系列中，早于 22.3R3-S5 的版本； 22.4 系列中，早于 22.4R3-S9 的版本；
Affected Version Matrix 7
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Juniper Networks | Junos OS | < 23.2R2-S7.7 |
affected |
23.4< 23.4R2-S8.13 |
affected | ||
24.2< 24.2R2-S5.5 |
affected | ||
24.4< 24.4R2-S5 |
affected | ||
25.2< 25.2R2-S2 |
affected | ||
25.4< 25.4R1-S3 |
affected | ||
26.2< 26.2R1-S2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102182
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Junos OS: MX Series: Certificate-based IKE packets cause root-level code execution
Source: CVE Program / CVE List V5
Vulnerability Description
A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.
This issue affects Junos OS on MX Series:
* All versions before 21.2R3-S11;
* from 21.4 before 21.4R3-S12;
* from 22.2 before 22.2R3-S8;
* from 22.3 before 22.3R3-S5;
* from 22.4 before 22.4R3-S9;
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Juniper Networks | Junos OS | 0 ~ 23.2R2-S7.7 | - |
|
II. Public POCs for CVE-2026-102182
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102182
请登录查看更多情报信息。
Other References for CVE-2026-102182 (1)
-
Article Detail vendor-advisory
Same Patch Batch · Juniper Networks · 2026-10-14 · 153 CVEs total
| CVE-2026-101954 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover |
| CVE-2026-102031 | 9.8 CRITICAL | Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authori |
| CVE-2026-33789 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a speci |
| CVE-2026-33792 | 9.8 CRITICAL | Junos OS: SRX Series: An attacker causes remote code execution and denial of service when |
| CVE-2026-33796 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP r |
| CVE-2026-101990 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re |
| CVE-2026-101950 | 9.8 CRITICAL | Junos OS: SRX Series: Malformed IPv4 packets cause packet-forwarding process crash when Se |
| CVE-2026-101986 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: J-Web permits pre-authentication CGI execution |
| CVE-2026-101956 | 9.8 CRITICAL | Junos OS: Unauthorized root command execution when J-Web is enabled |
| CVE-2026-102178 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: When BGP update-threading is enabled a specifically malform |
| CVE-2026-101983 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: An attacker causes remote code execution when J-Web virtual |
| CVE-2026-101980 | 9.8 CRITICAL | Junos OS: Malformed Extended Echo requests cause a Routing Engine reboot when Extended Ech |
| CVE-2026-101982 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: A EVPN peer causes an rpd crash or root-level compromise wh |
| CVE-2026-102175 | 9.8 CRITICAL | Junos OS and Junos OS Evolved: An attacker causes remote code execution or denial of servi |
| CVE-2026-102050 | 8.8 HIGH | Junos OS and Junos OS Evolved: An adjacent attacker causes Layer 2 control-plane denial of |
| CVE-2026-102059 | 8.8 HIGH | Junos OS and Junos OS Evolved: EX Series, SRX Series, QFX Series: A rogue DHCP server caus |
| CVE-2026-102061 | 8.8 HIGH | Junos OS and Junos OS Evolved: An attacker causes root code execution when SZTP DHCP provi |
| CVE-2026-102174 | 8.8 HIGH | Junos OS: SRX Series: An authenticated remote-access VPN client causes iked denial of serv |
| CVE-2026-102055 | 8.8 HIGH | Junos OS and Junos OS Evolved: MX Series, PTX Series: An attacker causes remote code execu |
| CVE-2026-102052 | 8.8 HIGH | Junos OS and Junos OS Evolved: An attacker causes jdhcpd to crash when the DHCPv4 local-cl |
Showing top 20 of 153 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Junos OS
-
CVE-2026-101954
Junos OS and Junos OS Evolved: Unauthenticated network acces -
CVE-2026-101952
Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update -
CVE-2026-101949
Junos OS and Junos OS Evolved: In a scenario with VPN-flowsp -
CVE-2026-101964
Junos OS and Junos OS Evolved: An attacker can cause an rpd -
CVE-2026-101963
Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an
Same vendor: Juniper Networks
-
CVE-2026-101954
Junos OS and Junos OS Evolved: Unauthenticated network acces -
CVE-2026-101952
Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update -
CVE-2026-101949
Junos OS and Junos OS Evolved: In a scenario with VPN-flowsp -
CVE-2026-101964
Junos OS and Junos OS Evolved: An attacker can cause an rpd -
CVE-2026-101963
Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an
Same weakness: CWE-121
-
CVE-2026-79840
HPE NonStop XABroker - Memory corruption vulnerability -
CVE-2026-79839
HPE NonStop ODBC/MX Server - Memory corruption vulnerability -
CVE-2026-79838
HPE NonStop ODBC/MX Services - Memory corruption vulnerabili -
CVE-2026-79832
HPE NonStop SQL/MX Executor - Buffer overflow vulnerability -
CVE-2026-79830
HPE NonStop Kernel Level Thread Model Lib - Stack buffer ove
V. Comments for CVE-2026-102182
No comments yet