Junos OS 21.2-24.4 Stack Overflow in kmd Allows Unauthenticated Root Code Execution via IKE
A stack buffer overflow in Junos OS allows unauthenticated attackers to execute root code on affected MX Series routers via IKE packets.
Key points
- CVE-2026-102182 carries a CVSS score of 9.8, rated Critical by the National Vulnerability Database.
- The flaw exists in the kmd component and permits code execution as root without authentication.
- Multiple Junos OS versions on MX Series routers are affected, spanning releases from 21.2 through 24.4.
Juniper Networks MX Series routers running specific versions of Junos OS contain a critical vulnerability that allows unauthenticated remote code execution. The National Vulnerability Database rates CVE-2026-102182 as Critical with a CVSS score of 9.8. This flaw enables attackers to run code with root privileges by sending specially crafted packets to the device.
What happened
The National Vulnerability Database published a record for CVE-2026-102182, identifying a stack-based buffer overflow in the kmd component of Juniper Networks Junos OS. This weakness, categorized under CWE-121, affects MX Series routers. An unauthenticated network attacker can exploit this issue by sending specific IKE certificate-based packets to the vulnerable system. Successful exploitation allows the attacker to execute arbitrary code with root privileges on the device. The vulnerability does not require any form of authentication or prior access to the router's management interface.
Why it matters
The severity of this flaw is underscored by its CVSS score of 9.8, which the National Vulnerability Database classifies as Critical. This rating reflects the ease of exploitation and the severe impact of gaining root access on network infrastructure. The kmd component is identified as the location of the stack-based buffer overflow vulnerability. Because the attack vector is unauthenticated and remote, any MX Series router exposed to the network is at risk. The National Vulnerability Database states that an unauthenticated network attacker can execute code as root via specific IKE certificate-based packets.
What to watch
- Monitor for unusual IKE traffic patterns or unexpected certificate requests on MX Series routers.
- Check system logs for signs of buffer overflow attempts or unauthorized root-level processes.
- Verify that all MX Series routers are running patched versions of Junos OS.
- Look for any public exploits or proof-of-concept code related to CVE-2026-102182.
Who needs to act first
Teams should prioritize updating MX Series routers that are directly exposed to untrusted networks or the internet. These devices face the highest risk of unauthenticated attacks. Before applying updates, administrators should back up current configurations to ensure recovery options are available. Testing the update in a non-production environment helps verify stability and compatibility. If immediate patching is not possible, restricting access to IKE services through firewall rules can reduce exposure. Regularly reviewing network traffic for anomalies is also advisable during this period.
Background: CVSS score
The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.
Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes
What to do and how to stay safe: Juniper Networks
- Inventory all MX Series routers and check their current Junos OS versions against the affected list.
- Apply the latest available security updates from Juniper Networks to patch the vulnerability.
- Implement network segmentation to limit exposure of critical routers to untrusted networks.
- Monitor for any signs of exploitation, such as unusual IKE traffic or unauthorized access attempts.
Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks
General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Junos OS versions are affected by CVE-2026-102182?
Versions before 21.2R3-S11, 21.4 before 21.4R3-S12, 22.2 before 22.2R3-S8, 22.3 before 22.3R3-S5, and 22.4 before 22.4R3-S9 are affected, along with specific versions up to 24.4.
What is the CVSS score for this vulnerability?
The National Vulnerability Database assigns a CVSS score of 9.8, rating it as Critical.
Can this vulnerability be exploited without authentication?
Yes, the flaw allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.
