CVE-2026-102182

Summary

A stack-based buffer overflow in Juniper's kmd component allows unauthenticated attackers to execute code as root via specially crafted IKE certificate packets. This represents a critical remote code execution vulnerability that could lead to complete system compromise.

Exploitability

Exploitation is relatively straightforward as it requires only sending specific IKE certificate-based packets over the network without authentication, making it highly suitable for automated attacks.

Blast radius

The vulnerability affects all MX Series routers running supported Junos OS versions, potentially impacting critical network infrastructure with widespread remote access capabilities and high-value network services.

Detection

Monitor for unusual IKE packet processing activity in system logs, particularly around certificate handling operations, and watch for unexpected kmd process restarts or memory allocation errors in the Junos OS logs.

Prioritized remediation

Upgrade to 21.2R3-S11, 21.4R3-S12, 22.2R3-S8, 22.3R3-S5, or 22.4R3-S9 depending on the current version, as these releases contain the necessary patches for the kmd component buffer overflow.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.