Junos OS on MX: stack overflow in kmd gives unauthenticated root via IKE certificate packets

CVSS 9.3CVE-2026-102182Firmware, BMC & network fabriccurated

Impact

Specific IKE certificate-based packets overflow a stack buffer in kmd, the Junos key management daemon, and execute code as root on MX Series routers - with no authentication first. MX routers are the edge and interconnect of many datacenter builds, so root there means control over the path that carries cluster traffic to storage, to other sites, and to the internet, plus whatever IPsec keying material the device holds. This is the most directly exploitable item in Juniper's JSA112196 set: unauthenticated, network-reachable, code execution as root.

Who can reach it

Network, unauthenticated. Anyone who can send IKE packets to an MX Series router - that is, any source that can reach the device's IKE listener, which for a VPN termination point is often the internet-facing address.

What to do

Upgrade per Juniper advisory JSA112196: 21.2R3-S11 or later for pre-21.4 trains, 21.4R3-S12, 22.2R3-S8, 22.3R3-S5, or 22.4R3-S9 for those branches. The upgrade reboots the router, so plan around the redundancy of the MX pair; if the device is a single point of exit, this needs a real window. Until it is applied, filter IKE reachability to the peers you expect.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102182 https://supportportal.juniper.net/JSA112196

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.