CVE-2026-102182: Critical 9.8 Flaw in Juniper MX kmd Enables Remote Unauthenticated Root Code Execution

A critical security flaw in Juniper Networks MX Series routers allows remote attackers to take full control of the device without needing any login credentials. The vulnerability, identified as CVE-2026-102182, carries a CVSS score of 9.8, which the National Vulnerability Database classifies as Critical. This high severity rating reflects the ease of exploitation and the severe impact of successful attacks.

The risk

The vulnerability stems from a stack-based buffer overflow in the kmd component of Junos OS. According to the NVD record, this weakness corresponds to CWE-121. An unauthenticated network attacker can trigger the flaw by sending specific IKE certificate-based packets to the router. Successful exploitation allows the attacker to execute arbitrary code with root privileges. This level of access grants complete control over the compromised system.

Who is exposed

Multiple versions of Junos OS on MX Series devices are affected by this issue. The NVD record lists numerous release branches that remain vulnerable. Affected versions include all releases before 21.2R3-S11 and those from 21.4 before 21.4R3-S12. Additionally, versions from 22.2 before 22.2R3-S8, 22.3 before 22.3R3-S5, and 22.4 before 22.4R3-S9 are at risk. Newer branches such as 23.2, 23.4, 24.2, and 24.4 are also affected if they are below their respective service release thresholds.

Cost and compliance

The source material does not provide specific details regarding financial costs or regulatory compliance implications for this vulnerability. The NVD record focuses solely on the technical description, severity rating, and affected software versions. No information about data breaches, financial losses, or specific compliance frameworks is included in the provided documentation. Organizations must assess their own risk based on the critical nature of the flaw.

What should you do?

Network administrators should immediately verify if their MX Series routers are running any of the affected Junos OS versions listed in the NVD record. Those using vulnerable software should plan to upgrade to the specified service releases or newer versions to mitigate the risk. Until updates are applied, consider restricting access to IKE services from untrusted networks.

The background in plain language

Teams usually need to understand how buffer overflows and unauthenticated access work to grasp this risk. A buffer overflow occurs when a program writes more data to a memory block than it can hold, potentially overwriting adjacent memory. This can allow attackers to inject and run malicious code. Unauthenticated access means the attacker does not need a password or login token to initiate the attack. These concepts explain why remote attackers can seize control of network devices without prior intrusion.

Background: Buffer overflow vulnerabilities

Prevent buffer overflows by using memory-safe languages, enabling compiler stack protection, and validating all input lengths. This checklist provides specific code and build steps to stop attackers from writing data past allocated memory limits and executing arbitrary commands on your systems.

Read the full guide: Buffer Overflow Prevention Checklist for Secure Code

What to do and how to stay safe: Juniper Networks

• Audit your inventory to identify all MX Series routers running Junos OS versions prior to the specified secure releases.
• Monitor network logs for unusual IKE traffic patterns that might indicate exploitation attempts.
• Segment networks to limit exposure of critical infrastructure to untrusted external sources.
• Once the vendor provides an update, test and deploy the patch promptly to affected systems.

Step-by-step guide: Detect Data Breaches: Hidden Signals in Logs and System Behavior

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-102182?

The CVSS score for CVE-2026-102182 is 9.8, which is classified as Critical.

Which component of Junos OS is vulnerable?

The kmd component of Junos OS on MX Series is vulnerable to the stack-based buffer overflow.

Can an attacker exploit this vulnerability without authentication?

Yes, an unauthenticated network attacker can exploit this vulnerability via specific IKE packets.