Junos OS on SRX Series: Remote code execution in ADVPN VPN daemon
Summary
Junos OS on SRX Series contains an improper input validation flaw in the VPN daemon when AutoDiscovery VPN (ADVPN) is configured. A specially malformed message from a peer causes a buffer overflow that can allow remote code execution and complete control of the device. The attacker must hold the shared secret to impersonate a peer or have compromised an existing peer, which the vendor describes as considerably difficult.
Affected
- Junos OS on SRX Series before 23.2R2-S7.7
- Junos OS on SRX Series 23.4 before 23.4R2-S7
- Junos OS on SRX Series 24.2 before 24.2R2-S4
- Junos OS on SRX Series 24.4 before 24.4R2-S3
- Junos OS on SRX Series 25.2 before 25.2R2
- Junos OS on SRX Series 25.4 before 25.4R1-S3
- Exposure requires ADVPN to be configured (default: unaffected)
Fixed in
- Junos OS 23.2R2-S7.7
- Junos OS 23.4R2-S7
- Junos OS 24.2R2-S4
- Junos OS 24.4R2-S3
- Junos OS 25.2R2
- Junos OS 25.4R1-S3
- Junos OS 26.2R1 and all subsequent releases
- Release 23.2 has been respun; previously published builds of this release were rebuilt.
- Exact build numbers per platform: Unknown.
Workaround
There are no known workarounds for this issue.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV; EPSS below 1%.
- No public proof of concept found in the research notes; absence of evidence, not confirmation.
Our recommendation
- Check whether ADVPN is configured on your SRX devices.
- If ADVPN is used, upgrade to the fixed release for your branch and verify the exact build in Juniper advisory JSA112173.
- Since no workaround exists, patching is the only documented fix.
- Restrict and review VPN peer shared secrets and monitor VPN daemon logs for unusual IKE or ADVPN messages.
- Patch the other SRX flaws in the October 2026 bulletin in the same maintenance window.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112173 supportportal.juniper.net
- OpenCVE: CVE-2026-102084 app.opencve.io
- Vulners/Juniper record (VulnRichment) vulners.com
- Juniper Feature Explorer: ADVPN apps.juniper.net
- Radar/OffSeq: CVE-2026-102084 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:26.
Original description (NVD)
An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker to take complete control of the device. If an SRX device configured for AutoDiscovery VPN (ADVPN) receives a message from a peer that contains one or more specifically malformed attributes, this will cause a buffer overflow, which can allow remote code execution and therefore allow an attacker to take complete control of the device. To be able to carry out this attack an attacker must either have acquired the shared secret to impersonate a peer or have compromised an existing one, so this attack is considerably difficult. This issue affects Junos OS on SRX Series: * All versions before 23.2R2-S7.7; * from 23.4 before 23.4R2-S7; * from 24.2 before 24.2R2-S4; * from 24.4 before 24.4R2-S3; * from 25.2 before 25.2R2; * from 25.4 before 25.4R1-S3.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.