Junos OS: SRX Series: In an ADVPN scenario a malformed message from a peer causes Remote Code Execution
An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker to take complete control of the device. If an SRX device configured for AutoDiscovery VPN (ADVPN) receives a message from a peer that contains one or more specifically malformed attributes, this will cause a buffer overflow, which can allow remote code execution and therefore allow an attacker to take complete control of the device. To be able to carry out this attack an attacker must either have acquired the shared secret to impersonate a peer or have compromised an existing one, so this attack is considerably difficult. This issue affects Junos OS on SRX Series: * All versions before 23.2R2-S7.7; * from 23.4 before 23.4R2-S7; * from 24.2 before 24.2R2-S4; * from 24.4 before 24.4R2-S3; * from 25.2 before 25.2R2; * from 25.4 before 25.4R1-S3.
CVE-2026-102084
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-102084
Junos OS
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Juniper Networks",
"product": "Junos OS",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "23.2R2-S7.7",
"versionType": "custom"
},
{
"status": "affected",
"version": "23.4",
"lessThan": "23.4R2-S7",
"versionType": "custom"
},
{
"status": "affected",
"version": "24.2",
"lessThan": "24.2R2-S4",
"versionType": "custom"
},
{
"status": "affected",
"version": "24.4",
"lessThan": "24.4R2-S3",
"versionType": "custom"
},
{
"status": "affected",
"version": "25.2",
"lessThan": "25.2R2",
"versionType": "custom"
},
{
"status": "affected",
"version": "25.4",
"lessThan": "25.4R1-S3",
"versionType": "custom"
}
],
"platforms": [
"SRX Series"
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-102084
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #28513 · Revision 1
- Added to Heist Feed
- Publisher date