{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-102182",
        "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "state": "PUBLISHED",
        "assignerShortName": "juniper",
        "dateReserved": "2026-09-28T18:17:13.470Z",
        "datePublished": "2026-10-14T16:57:50.508Z",
        "dateUpdated": "2026-10-20T20:30:29.536Z"
    },
    "containers": {
        "cna": {
            "affected": [
                {
                    "defaultStatus": "unaffected",
                    "platforms": [
                        "MX Series"
                    ],
                    "product": "Junos OS",
                    "vendor": "Juniper Networks",
                    "versions": [
                        {
                            "lessThan": "23.2R2-S7.7",
                            "status": "affected",
                            "version": "0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "23.4R2-S8.13",
                            "status": "affected",
                            "version": "23.4",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "24.2R2-S5.5",
                            "status": "affected",
                            "version": "24.2",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "24.4R2-S5",
                            "status": "affected",
                            "version": "24.4",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "25.2R2-S2",
                            "status": "affected",
                            "version": "25.2",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "25.4R1-S3",
                            "status": "affected",
                            "version": "25.4",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "26.2R1-S2",
                            "status": "affected",
                            "version": "26.2",
                            "versionType": "custom"
                        }
                    ]
                }
            ],
            "configurations": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "Vulnerable systems require two \n\n<span style=\"background-color: rgb(255, 255, 255);\">configuration </span>\n\nconditions to be met:\n<br>\n<br>- Condition 1: kmd up and accepting IKE on a gateway address<br><br>\n\n<tt>[ interfaces &lt;interface&gt; unit 0 family inet ]<br>[ services service-set VPN interface-service service-interface &lt;interface&gt; ]<br>[ services service-set VPN ipsec-vpn-options local-gateway &lt;address&gt; ]<br>[ services service-set VPN ipsec-vpn-rules R1 ]<br>[ services ipsec-vpn rule R1 match-direction input ]<br>[ services ipsec-vpn rule R1 term T1 then remote-gateway &lt;address&gt; ]<br>[ services ipsec-vpn rule R1 term T1 then dynamic ike-policy IKE-POL ]</tt><br>\n<br>- Condition 2: RSA-signature IKE policy with a CA-signed local certificate<br>\n<br>\n<tt>[ services ipsec-vpn ike proposal IKE-PROP authentication-method rsa-signatures ]<br>[ services ipsec-vpn ike policy IKE-POL mode aggressive ]<br>[ services ipsec-vpn ike policy IKE-POL proposals IKE-PROP ]<br>[ services ipsec-vpn ike policy IKE-POL local-certificate EE-CERT ]<br>[ security pki ca-profile CA1 ca-identity &lt;CA-name&gt; ]<br>[ services service-set VPN ipsec-vpn-options trusted-ca CA1 ]</tt>\n<br><br>"
                        }
                    ],
                    "value": "Vulnerable systems require two \n\nconfiguration \n\nconditions to be met:\n\n\n\n- Condition 1: kmd up and accepting IKE on a gateway address\n\n\n\n[ interfaces <interface> unit 0 family inet ]\n[ services service-set VPN interface-service service-interface <interface> ]\n[ services service-set VPN ipsec-vpn-options local-gateway <address> ]\n[ services service-set VPN ipsec-vpn-rules R1 ]\n[ services ipsec-vpn rule R1 match-direction input ]\n[ services ipsec-vpn rule R1 term T1 then remote-gateway <address> ]\n[ services ipsec-vpn rule R1 term T1 then dynamic ike-policy IKE-POL ]\n\n\n- Condition 2: RSA-signature IKE policy with a CA-signed local certificate\n\n\n\n[ services ipsec-vpn ike proposal IKE-PROP authentication-method rsa-signatures ]\n[ services ipsec-vpn ike policy IKE-POL mode aggressive ]\n[ services ipsec-vpn ike policy IKE-POL proposals IKE-PROP ]\n[ services ipsec-vpn ike policy IKE-POL local-certificate EE-CERT ]\n[ security pki ca-profile CA1 ca-identity <CA-name> ]\n[ services service-set VPN ipsec-vpn-options trusted-ca CA1 ]"
                }
            ],
            "datePublic": "2026-10-14T16:00:00.000Z",
            "descriptions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.<br><br>This issue requires IKE to be enabled with an RSA-signature IKE policy to be vulnerable.<br><br><p>This issue affects Junos OS on MX Series:<br></p><ul><li>All versions before 21.2R3-S11;</li><li>from 21.4 before 21.4R3-S12;</li><li>from 22.2 before 22.2R3-S8;</li><li>from 22.3 before 22.3R3-S5;</li><li>from 22.4 before 22.4R3-S9;</li></ul><p></p>"
                        }
                    ],
                    "value": "A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.\n\nThis issue requires IKE to be enabled with an RSA-signature IKE policy to be vulnerable.\n\nThis issue affects Junos OS on MX Series:\n\n\n  *  All versions before 21.2R3-S11;\n  *  from 21.4 before 21.4R3-S12;\n  *  from 22.2 before 22.2R3-S8;\n  *  from 22.3 before 22.3R3-S5;\n  *  from 22.4 before 22.4R3-S9;"
                }
            ],
            "exploits": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
                        }
                    ],
                    "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "attackComplexity": "LOW",
                        "attackVector": "NETWORK",
                        "availabilityImpact": "HIGH",
                        "baseScore": 9.8,
                        "baseSeverity": "CRITICAL",
                        "confidentialityImpact": "HIGH",
                        "integrityImpact": "HIGH",
                        "privilegesRequired": "NONE",
                        "scope": "UNCHANGED",
                        "userInteraction": "NONE",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                        "version": "3.1"
                    },
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ]
                },
                {
                    "cvssV4_0": {
                        "Automatable": "YES",
                        "Recovery": "AUTOMATIC",
                        "Safety": "NOT_DEFINED",
                        "attackComplexity": "LOW",
                        "attackRequirements": "NONE",
                        "attackVector": "NETWORK",
                        "baseScore": 9.3,
                        "baseSeverity": "CRITICAL",
                        "privilegesRequired": "NONE",
                        "providerUrgency": "NOT_DEFINED",
                        "subAvailabilityImpact": "LOW",
                        "subConfidentialityImpact": "NONE",
                        "subIntegrityImpact": "NONE",
                        "userInteraction": "NONE",
                        "valueDensity": "CONCENTRATED",
                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M",
                        "version": "4.0",
                        "vulnAvailabilityImpact": "HIGH",
                        "vulnConfidentialityImpact": "HIGH",
                        "vulnIntegrityImpact": "HIGH",
                        "vulnerabilityResponseEffort": "MODERATE"
                    },
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ]
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "cweId": "CWE-121",
                            "description": "CWE-121 Stack-based Buffer Overflow",
                            "lang": "en",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
                "shortName": "juniper",
                "dateUpdated": "2026-10-20T20:30:29.536Z"
            },
            "references": [
                {
                    "tags": [
                        "vendor-advisory"
                    ],
                    "url": "https://supportportal.juniper.net/JSA112196"
                }
            ],
            "solutions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": true,
                            "type": "text/html",
                            "value": "The following software releases have been updated to resolve this specific issue:<br>\n<br>\nJunos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.<br><br><b>Note:</b> For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory."
                        }
                    ],
                    "value": "The following software releases have been updated to resolve this specific issue:\n\n\n\nJunos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.\n\nNote: For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory."
                }
            ],
            "source": {
                "advisory": "JSA112196",
                "defect": [
                    "1952216"
                ],
                "discovery": "INTERNAL"
            },
            "timeline": [
                {
                    "lang": "en",
                    "time": "2026-10-14T16:00:00.000Z",
                    "value": "Initial Publication"
                },
                {
                    "lang": "en",
                    "time": "2026-10-20T16:00:00.000Z",
                    "value": "Added required IKE configuration"
                }
            ],
            "title": "Junos OS: MX Series: Certificate-based IKE packets cause root-level code execution",
            "workarounds": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "There are no known workarounds for this issue."
                        }
                    ],
                    "value": "There are no known workarounds for this issue."
                }
            ],
            "x_generator": {
                "engine": "Vulnogram 0.1.0-dev"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2026-10-14T00:00:00+00:00",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "yes"
                                    },
                                    {
                                        "Technical Impact": "total"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3",
                                "id": "CVE-2026-102182"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-10-15T03:57:08.066Z"
                }
            }
        ]
    }
}