All vulnerabilities
CVE-2026-102084

Junos OS: SRX Series: In an ADVPN scenario a malformed message from a peer causes Remote Code Execution

Juniper Networks Junos OSNetwork & edge
Open in ThreatlineRecord JSON
CVSS
8.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.51%Chance of exploitation activity in the next 30 days, higher than 42% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in23.2R2-S7.7Also 23.4R2-S7, 24.2R2-S4 and 3 moreCVE List
Published14 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker to take complete control of the device.

If an SRX device configured for AutoDiscovery VPN (ADVPN) receives a message from a peer that contains one or more specifically malformed attributes, this will cause a buffer overflow, which can allow remote code execution and therefore allow an attacker to take complete control of the device. To be able to carry out this attack an attacker must either have acquired the shared secret to impersonate a peer or have compromised an existing one, so this attack is considerably difficult.

This issue affects Junos OS on SRX Series:

  • All versions before 23.2R2-S7.7;
  • from 23.4 before 23.4R2-S7;
  • from 24.2 before 24.2R2-S4;
  • from 24.4 before 24.4R2-S3;
  • from 25.2 before 25.2R2;
  • from 25.4 before 25.4R1-S3.

Text from CVE List

Affected versions 6

  • Junos OSaffected: all versions before 23.2R2-S7.7CVE List
  • Junos OSaffected: 23.4 before 23.4R2-S7CVE List
  • Junos OSaffected: 24.2 before 24.2R2-S4CVE List
  • Junos OSaffected: 24.4 before 24.4R2-S3CVE List
  • Junos OSaffected: 25.2 before 25.2R2CVE List
  • Junos OSaffected: 25.4 before 25.4R1-S3CVE List

References 1