Junos OS on SRX: stack overflow in iked lets an authenticated VPN client run code as root

CVSS 8.7CVE-2026-102174Firmware, BMC & network fabriccurated

Impact

A stack-based buffer overflow in the iked IKE key-management daemon is reachable through the remote-access VPN authentication and JIMS identity-publishing path, allowing an authenticated remote-access VPN client to execute code as root or crash the daemon. The privilege required is only that of a VPN user (PR:L), which in most deployments is a much larger population than the set of people allowed to administer the firewall - any employee or contractor credential, or any stolen one, becomes a path to root on the device. Crashing iked alone drops every IPsec tunnel terminated on the SRX, including site-to-site links carrying management or replication traffic.

Who can reach it

Network, authenticated as a remote-access VPN client. Requires remote-access VPN to be configured on the SRX; the JIMS identity-publishing path is part of the reachable code. No administrative privilege is needed.

What to do

Upgrade Junos OS per Juniper advisory JSA112186; fixed releases are not present in the NVD record. There is no clean mitigation short of disabling remote-access VPN, since the exposure is the authenticated VPN path itself - tightening who holds VPN credentials reduces, but does not remove, the attacker population. The upgrade reboots the chassis and drops all tunnels, so schedule it with the VPN users in mind or fail over to the HA peer.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102174 https://supportportal.juniper.net/JSA112186

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.