Juniper MX Series Routers Face Critical Unauthenticated RCE Flaw in IKE Component
A stack-based buffer overflow in Juniper Junos OS allows remote attackers to execute code as root without authentication on affected MX Series devices.
Key points
- CVE-2026-102182 is rated critical with CVSS scores of 9.3 and 9.8.
- The flaw exists in the kmd component of Junos OS on MX Series routers.
- Attackers can exploit the issue via specific IKE certificate-based packets.
Juniper Networks MX Series routers running Junos OS contain a critical vulnerability that permits unauthenticated remote code execution. The flaw, identified as CVE-2026-102182, allows attackers to run commands with root privileges by sending specially crafted IKE certificate-based packets to the affected kmd component.
At a glance
- CVE
- CVE-2026-102182
- Product
- Juniper Networks Junos OS
- CVSS
- 9.8 Critical
- Weakness
- stack-based buffer overflow
- Exploited
- No known exploitation
National Vulnerability Database records list the issue with two separate CVSS scores, 9.3 and 9.8, both categorized as critical. The underlying weakness is a stack-based buffer overflow, classified under CWE-121. This type of error occurs when a program writes more data to a buffer than it can hold, potentially overwriting adjacent memory and enabling arbitrary code execution by a network attacker.
Context and Background
The vulnerability resides specifically within the kmd component of the Junos operating system. According to the NVD records, the attack vector is network-based and requires no authentication. An attacker does not need valid credentials or prior access to the system to trigger the buffer overflow.
The exploit mechanism involves sending specific Internet Key Exchange (IKE) packets that rely on certificates. When the kmd component processes these malformed packets, the stack-based buffer overflow occurs. This allows the remote attacker to execute code with the highest level of system privileges, effectively taking full control of the router.
Who Is Affected
Multiple versions of Junos OS on MX Series routers are vulnerable to CVE-2026-102182. The NVD records specify that all versions prior to 21.2R3-S11 are affected. Additionally, versions starting from 21.4 up to, but not including, 21.4R3-S12 contain the flaw.
The vulnerability also impacts routers running Junos OS versions from 22.2 before 22.2R3-S8, and those from 22.3 before 22.3R3-S5. Furthermore, devices operating on versions from 22.4 before 22.4R3-S9 are susceptible to this unauthenticated remote code execution attack.
More recent releases are also listed as affected. This includes Junos OS versions before 23.2R2-S7.7, before 23.4R2-S8.13, before 24.2R2-S5.5, and before 24.4R2-S5. Organizations using any of these specific version ranges on their MX Series hardware are exposed to this critical security risk.
What should you do?
No patch or fix has been confirmed in the provided source material. Administrators should verify their current Junos OS versions against the affected lists above. If a device runs a vulnerable version, it is exposed to unauthenticated remote code execution. Monitor vendor communications for official updates or mitigation guidance.
What to do and how to stay safe: Juniper Networks
- Audit all MX Series routers to identify devices running vulnerable Junos OS versions listed in the NVD records.
- Isolate affected devices from untrusted networks if possible to reduce exposure to unauthenticated IKE packets.
- Monitor network traffic for anomalous IKE certificate-based packet activity that could indicate exploitation attempts.
- Wait for the vendor to provide an official update or patch before making configuration changes that might impact stability.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-102182?
It is a critical stack-based buffer overflow vulnerability in the kmd component of Juniper Junos OS on MX Series routers.
Can attackers exploit this without credentials?
Yes, the vulnerability allows an unauthenticated network attacker to execute code as root via specific IKE packets.
Which Juniper products are affected?
The flaw affects Junos OS on MX Series routers across multiple version branches, including those before 21.2R3-S11 and various later releases.
