Juniper Junos OS: Stack-based buffer overflow in kmd on MX Series

Summary

A stack-based buffer overflow in the kmd daemon of Junos OS on MX Series routers allows an unauthenticated network attacker to execute code as root. The attacker only needs to send specially crafted certificate-based IKE packets. The device is only vulnerable if IKE is enabled with an RSA-signature IKE policy.

Affected

• Junos OS on MX Series per the CVE data: all versions before 21.2R3-S11; 21.4 before 21.4R3-S12; 22.2 before 22.2R3-S8; 22.3 before 22.3R3-S5; 22.4 before 22.4R3-S9
• The official CVE record lists a different range: 0 to before 23.2R2-S7.7; 23.4 to before 23.4R2-S8.13; 24.2 to before 24.2R2-S5.5; 24.4 to before 24.4R2-S5; 25.2 to before 25.2R2-S2; 25.4 to before 25.4R1-S3; 26.2 to before 26.2R1-S2
• Conditions: IKE enabled on a gateway address and an RSA-signature IKE policy with a CA-signed local certificate

Fixed in

• Per the official CVE record: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all later releases
• Fixed versions for 21.2, 21.4, 22.2, 22.3 and 22.4 are not confirmed by the sources checked; verify in JSA112196
• Some 23.2, 23.4 and 24.2 releases were respun; previously published versions were rebuilt

Workaround

• Vendor: no known workarounds
• Check whether IKE with an RSA-signature policy is in use and disable unused policies (confirm the effect on your configuration first)
• Restrict IKE access to trusted peers only

Exploitation

• Juniper SIRT is not aware of any malicious exploitation
• CISA SSVC: exploitation none, automatable yes, technical impact total
• No public proof-of-concept found in the sources checked; recheck GitHub and researcher sources

Our recommendation

• Check whether you run MX Series routers with IKE and RSA-signature policies; if not, no action needed beyond normal patching
• Determine your exact Junos release and compare it with JSA112196 before upgrading
• Apply the vendor fix as soon as possible; restrict IKE reachability in the meantime
• Monitor IKE logs for unusual or malformed packets

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112196 supportportal.juniper.net
• OpenCVE: CVE-2026-102182 app.opencve.io
• VulDB: CVE-2026-102182 vuldb.com
• FastNetMon: Critical Juniper Junos OS vulnerabilities (BGP FlowSpec and IKE) fastnetmon.com
• SecurityOnline: Juniper patches critical Junos OS vulnerabilities securityonline.info

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:53.