Junos OS: malformed first ISAKMP packet crashes kmd/iked and blocks all new IPsec SAs

CVSS 8.7CVE-2026-33778Firmware, BMC & network fabriccurated

Impact

An unauthenticated attacker who can send a specifically malformed first ISAKMP packet makes the kmd/iked key management process crash and restart, so no new security associations can be established while it recovers. Repeated packets keep it down and produce a complete inability to bring up VPN connections. Where an SRX or MX fronts a GPU site, that is the path remote staff, replication traffic and out-of-band management tunnels come in on: existing tunnels may survive but nothing new gets established, and rekey failures take sessions down over time. Availability only - no disclosure or configuration change is described.

Who can reach it

Network, unauthenticated: anyone who can reach the IKE listener on an affected SRX or MX device, which usually means the internet-facing interface terminating IPsec.

What to do

Upgrade Junos OS to 22.4R3-S9, 23.2R2-S6, 23.4R2-S7, 24.2R2-S4, 24.4R2-S3, or 25.2R1-S2 / 25.2R2 per Juniper JSA107868. A Junos upgrade reloads the device, so schedule it in a maintenance window and fail traffic over to the peer in a chassis cluster or redundant pair first. Interim mitigation is to restrict which peers can reach the IKE service.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-33778 https://kb.juniper.net/JSA107868

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.