# CVE-2026-102182: Juniper Junos OS stack buffer overflow in kmd component

Source: https://junglewise.ai/threats/cve-2026-102182-a-stack-based-buffer-overflow-vulnerability-in-the-kmd-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-102182 · Severity: critical · CVSS 9.8 · Published 2026-10-14

Juniper Junos OS on MX Series is a routing and switching platform used in enterprise networks. An unauthenticated attacker on the network can send specially crafted IKE certificate packets to execute arbitrary code as root, gaining complete control of the router. This requires IKE to be enabled with RSA-signature authentication, which is a common VPN configuration.

Vendors: [Juniper Networks](https://junglewise.ai/threats/vendors/juniper-networks).

## Quick answers

**Is CVE-2026-102182 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102182 being exploited in the wild.

**How severe is CVE-2026-102182?** Critical severity, with a CVSS score of 9.8, published 14 October 2026.

**Which products and versions are affected?** Juniper Networks Junos OS on MX Series before 21.2R3-S11; 21.4 before 21.4R3-S12; 22.2 before 22.2R3-S8; 22.3 before 22.3R3-S5; 22.4 before 22.4R3-S9.

**Is there a fix for CVE-2026-102182?** Yes: fixed in Junos OS 21.2R3-S11, 21.4R3-S12, 22.2R3-S8, 22.3R3-S5, 22.4R3-S9 and later. Until then: Disable IKE or restrict IKE access to trusted networks via access control lists until the device can be patched. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102182 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-102182?** Check whether you run Juniper Networks Junos OS on MX Series at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Junos OS 21.2R3-S11, 21.4R3-S12, 22.2R3-S8, 22.3R3-S5, 22.4R3-S9 and later

Disable IKE or restrict IKE access to trusted networks via access control lists until the device can be patched.

## Technical details

A stack-based buffer overflow in the kmd (key management daemon) component of Junos OS allows unauthenticated remote code execution via malformed IKE certificate-based packets. The vulnerability requires IKE to be enabled with an RSA-signature IKE policy; the attack vector is network-based with no authentication required. Successful exploitation grants root-level code execution on the affected MX Series routing device.

## Affected products

- Juniper Networks Junos OS on MX Series before 21.2R3-S11; 21.4 before 21.4R3-S12; 22.2 before 22.2R3-S8; 22.3 before 22.3R3-S5; 22.4 before 22.4R3-S9

## Timeline

- 2026-10-14: disclosed

## References

- [https://supportportal.juniper.net/JSA112196](https://supportportal.juniper.net/JSA112196)