Key points
- The flaw allows unauthenticated remote code execution with root privileges.
- It affects multiple Junos OS versions on MX Series routers before specific service releases.
- The vulnerability is rated Critical with a CVSS score of 9.8 or 9.3.
An unauthenticated network attacker can execute code as root on Juniper Networks MX Series routers. This capability stems from a stack-based buffer overflow in the kmd component, triggered by specific IKE certificate-based packets, according to the NVD record for CVE-2026-102182.
The vulnerability enables full system compromise without prior authentication. The NVD rates the issue as Critical, with CVSS scores of 9.8 and 9.3 listed for different configurations. The weakness lies within the kernel management daemon, allowing remote exploitation via standard internet key exchange traffic.
Context and background
The flaw is classified under CWE-121, indicating a stack-based buffer overflow. This class of vulnerability occurs when a program writes more data to a buffer than it can hold, overwriting adjacent memory. In this case, the overflow happens within the kmd component when processing specific IKE packets.
Affected versions
The issue impacts Junos OS on MX Series across several release lines. Affected versions include all releases before 21.2R3-S11, 21.4 before 21.4R3-S12, and 22.2 before 22.2R3-S8. It also affects 22.3 before 22.3R3-S5, 22.4 before 22.4R3-S9, and specific later versions before their respective service releases.
What happens next
No fix has been confirmed yet in the provided source material. Security teams should verify their current Junos OS versions against the affected list. Monitoring for unusual IKE traffic or unexpected process execution on MX Series devices is advisable while assessing exposure.
Why this attack works
Stack buffer overflows exploit poor input validation in memory management. Attackers craft packets that exceed expected buffer sizes, overwriting return addresses or function pointers. This technique grants control over program execution flow. Teams usually check for unpatched systems and monitor for anomalous network traffic patterns that might indicate exploitation attempts.
What to do and how to stay safe: Juniper Networks
- Inventory all Juniper MX Series routers and check their Junos OS versions against the affected list.
- Monitor network logs for unusual IKE certificate-based packet activity or unexpected outbound connections.
- Restrict access to IKE services using firewall rules if possible, limiting exposure to trusted sources only.
- Prepare to apply updates immediately once the vendor releases a patch for CVE-2026-102182.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-102182?
It is a stack-based buffer overflow in the kmd component of Juniper Junos OS on MX Series routers, allowing unauthenticated remote code execution.
What are the affected versions?
Versions before 21.2R3-S11, 21.4R3-S12, 22.2R3-S8, 22.3R3-S5, 22.4R3-S9, and specific later service releases are affected.
How severe is this vulnerability?
The NVD rates it as Critical with CVSS scores of 9.8 and 9.3, indicating a high level of severity.
