CVE-2026-102084: Junos OS: SRX Series: In an ADVPN scenario a malformed message from a peer causes Remote Code Execution
An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker to take complete control of the device.
If an SRX device configured for AutoDiscovery VPN (ADVPN) receives a message from a peer that contains one or more specifically malformed attributes, this will cause a buffer overflow, which can allow remote code execution and therefore allow an attacker to take complete control of the device. To be able to carry out this attack an attacker must either have acquired the shared secret to impersonate a peer or have compromised an existing one, so this attack is considerably difficult.
This issue affects Junos OS on SRX Series:
All versions before 23.2R2-S7.7; from 23.4 before 23.4R2-S7; from 24.2 before 24.2R2-S4; from 24.4 before 24.4R2-S3; from 25.2 before 25.2R2; from 25.4 before 25.4R1-S3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Junos OS on SRX Seriesto a version that resolves this vulnerability.Fixed in 23.2R2-S7.7 - Upgrade
Upgrade
Juniper Junos OS on SRX Seriesto a version that resolves this vulnerability.Fixed in 23.4R2-S7 - Upgrade
Upgrade
Juniper Junos OS on SRX Seriesto a version that resolves this vulnerability.Fixed in 24.2R2-S4 - Upgrade
Upgrade
Juniper Junos OS on SRX Seriesto a version that resolves this vulnerability.Fixed in 24.4R2-S3 - Upgrade
Upgrade
Juniper Junos OS on SRX Seriesto a version that resolves this vulnerability.Fixed in 25.2R2 - Upgrade
Upgrade
Juniper Junos OS on SRX Seriesto a version that resolves this vulnerability.Fixed in 25.4R1-S3 - Upgrade
Upgrade
Juniper Junos OS on SRX Seriesto a version that resolves this vulnerability.Fixed in 26.2R1
Event History
Frequently Asked Questions
Which SRX deployments are exposed to this issue?
The issue applies to SRX Series devices running affected Junos OS releases only when they are configured for AutoDiscovery VPN (ADVPN). A device must receive the malformed message from an ADVPN peer for the buffer overflow to be triggered.
What does an attacker need to exploit the vulnerability?
The attacker must be able to authenticate as an ADVPN peer. This requires obtaining the shared secret needed to impersonate a peer or compromising an existing peer.
What is the potential impact of successful exploitation?
Successful exploitation can cause a buffer overflow in the VPN daemon and enable remote code execution. An attacker could take complete control of the affected device.
Which Junos OS releases contain fixes?
Fixed releases are 23.2R2-S7.7 and later, 23.4R2-S7 and later, 24.2R2-S4 and later, 24.4R2-S3 and later, 25.2R2 and later, and 25.4R1-S3 and later. Earlier affected releases include all versions before 23.2R2-S7.7 and the specified release trains before their listed fixed versions.