CVE-2026-102182

Executive Summary

CVE-2026-102182 is a stack-based buffer overflow (CWE-121) in the kmd component of Juniper Networks Junos OS running on MX Series platforms. An unauthenticated, remote network attacker can trigger the flaw by sending specifically crafted IKE certificate-based packets, potentially achieving arbitrary code execution as root. With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), this represents a critical, pre-authentication remote code execution risk for internet-exposed MX Series devices with IKE/IPsec enabled.

Technical Analysis

The vulnerability resides in the kmd (Key Management Daemon) component of Junos OS on MX Series routers. kmd is responsible for IKE/IPsec key exchange and certificate handling. According to the NVD description, the defect is a stack-based buffer overflow (CWE-121) that is triggered through "specific IKE certificate-based packets."

CWE-121 describes a condition where a program writes more data to a fixed-length stack buffer than it can hold, corrupting adjacent stack memory (saved frame pointers, return addresses, and local variables). Because the overflow is on the stack, successful exploitation can redirect control flow, and in this case the described outcome is code execution with root privileges within the kmd process context.

Key characteristics derivable from the advisory:

• Attack vector: Network (AV:N) — remotely triggerable via IKE traffic.
• Authentication: None required (PR:N) — the malicious packet(s) are processed before authentication is established, consistent with an IKE certificate-handling path.
• Complexity: Low (AC:L) — no special conditions or race windows are described.
• User interaction: None (UI:N).
• Scope: Unchanged (S:U) — impact remains within the vulnerable component.
• Confidentiality/Integrity/Availability: All High (C:H/I:H/A:H), consistent with root-level code execution on the device.

The attack surface is the IKE service on MX Series devices. Because IKE typically listens on UDP/500 and UDP/4500, any MX platform with IKE/IPsec configured and reachable from untrusted networks presents an exposure surface. The exact parsing routine, certificate field, and memory layout within kmd are not specified in the available NVD description, and no public PoC or exploit code exists; therefore the precise malformed certificate structure cannot be enumerated without vendor advisory detail.

This CVE is distinct from the many Junos OS CVEs that require a valid IKE peer or administrator privileges. Here, the description explicitly states "unauthenticated network attacker," raising the severity tier substantially.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-102182. The attack chain below is inferred from the vulnerability class (stack-based buffer overflow) and the description (IKE certificate-based packets).

1. Reconnaissance / target identification. An attacker scans for internet-reachable Juniper MX Series devices with IKE/IPsec services exposed. Network discovery focuses on UDP/500 (IKE) and UDP/4500 (NAT-T). Fingerprinting of Junos OS IKE responders can be performed via standard IKEv1/IKEv2 probing. Devices with IKE configured and reachable from untrusted networks are candidates.

2. Triggering the flaw. The attacker sends a crafted IKE packet containing certificate-based payloads designed to exceed the bounds of a fixed-length stack buffer inside the kmd daemon. Because the vulnerability is triggered during certificate handling and requires no authentication, the malformed packet is processed early in the IKE exchange. The specific certificate extension or field that overflows the buffer is not disclosed in available data and must be treated as the vulnerability class dictates.

3. Payload / execution method (vulnerability-class level). A stack buffer overflow of this type allows an attacker to overwrite stack memory, potentially controlling the saved return address or other control data. Where mitigations (stack canaries, ASLR, non-executable stack) permit, the attacker achieves control-flow hijack and directs execution to attacker-supplied or ROP-style payloads. The advisory states the outcome is code execution as root, meaning the attacker gains the highest privilege level available on the device without needing any valid credentials.

4. Post-exploitation impact. Successful root-level code execution on an MX Series router has catastrophic implications: full control over routing and forwarding, ability to read or modify all traffic transiting the device, modification of device configuration, establishment of persistence, and potential use of the device as a pivot into adjacent internal network segments. Because the device sits on the network edge or core, compromise can degrade or intercept the entire traffic path.

Impact Assessment

• CVSS v3.1 base score: 9.8 (Critical).
• AV:N — remotely exploitable over the network.
• AC:L — no unusual conditions required.
• PR:N — unauthenticated.
• UI:N — no victim interaction required.
• S:U — impact confined to the vulnerable component.
• C:H / I:H / A:H — full loss of confidentiality, integrity, and availability expected.

Business impact. MX Series platforms are carrier-grade edge and core routers. A pre-authentication RCE as root means an adversary can:

• Intercept, redirect, or drop customer traffic (confidentiality and availability impact).
• Alter routing policy, BGP/OSPF adjacencies, or firewall filters (integrity impact).
• Disable or "brick" the device (availability impact).
• Pivot laterally into management networks behind the router.

Blast radius. Any Junos OS MX Series device with IKE/IPsec enabled and reachable from an untrusted network is in scope. Affected version lines span 21.2 through 22.4 branches (fixed thresholds listed in Affected Versions). Organizations running mixed Junos fleets must audit each MX device independently, since only specific maintenance releases contain the fix. Given the absence of a tracked patch, all listed branches should be treated as vulnerable until vendor confirmation.

Detection Guidance

Sigma Rule

title: Suspicious IKE Certificate-Based Packet Exploitation Attempt (CVE-2026-102182)
id: 7b3c9c2e-1f4a-4d6e-9a11-9f2c1a7e6b21
status: experimental
description: Detects crafted IKE certificate-based packets targeting the kmd daemon on Juniper MX Series (CVE-2026-102182). Correlates malformed IKE certificate payloads and kmd crash indicators on Junos hosts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102182
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026.102182
logsource:
  product: juniper
  service: kmd
detection:
  selection_pkt:
    event.action: 'ike_certificate_parse'
    event.outcome: 'malformed'
  selection_crash:
    process.name: 'kmd'
    event.category: 'process'
    event.type: 'end'
    process.exit_code: '139'
  selection_log:
    message|contains:
      - 'kmd'
      - 'IKE certificate'
  condition: selection_pkt or (selection_crash and selection_log)
falsepositives:
  - Legitimate malformed certificates from misconfigured peers
  - Internal vulnerability scanning
level: critical

YARA Rule

rule CVE_2026_102182_Junos_MX_kmd_IKE_Cert_BOF
{
    meta:
        description = "Detects IKE certificate payloads and kmd crash strings associated with CVE-2026-102182 on Juniper MX Series"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102182"
        date = "2026-01-01"
        cve = "CVE-2026-102182"
        severity = "critical"

    strings:
        $ike_v1 = { 01 10 02 00 }       // IKEv1 header presence (informational)
        $ike_v2 = { 21 20 22 08 }       // IKEv2 header presence (informational)
        $kmd    = "kmd" ascii nocase
        $cert   = "CERT" ascii wide
        $junos  = "Junos" ascii wide

    condition:
        (uint16(0) == 0x0110 or uint16(0) == 0x2120) and
        ($kmd or $cert) and
        $junos
}

Suricata IDS Rule

alert udp any any -> any 500 (msg:"CVE-2026-102182 Possible Juniper MX kmd IKE Certificate Buffer Overflow Attempt"; flow:stateless; content:"|01 10 02 00|"; depth:4; content:"|04|"; distance:0; content:"CERT"; nocase; threshold: type both, track by_src, count 5, seconds 60; reference:cve,2026-102182; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102182; classtype:attempted-admin; sid:2026102182; rev:1;)

alert udp any any -> any 4500 (msg:"CVE-2026-102182 Possible Juniper MX kmd IKE Certificate Buffer Overflow Attempt (NAT-T)"; flow:stateless; content:"|21 20 22 08|"; depth:4; content:"CERT"; nocase; threshold: type both, track by_src, count 5, seconds 60; reference:cve,2026-102182; classtype:attempted-admin; sid:2026102183; rev:1;)

Elastic Detection

sequence by host.id with maxspan=30s
  [ network where network.transport == "udp" and
      (destination.port == 500 or destination.port == 4500) and
      network.protocol == "ike" ]
  [ process where process.name == "kmd" and event.type == "end" ]

Splunk SPL Query

index=juniper_syslog sourcetype=juniper:junos
| search ("kmd" AND ("IKE" OR "certificate")) OR ("kmd" AND "core") OR ("kmd" AND "crash")
| stats count min(_time) as first_seen max(_time) as last_seen by host, message
| where count > 3
| eval severity="critical", cve="CVE-2026-102182"
| sort - count

Wazuh OSSEC Rule

<group name="juniper,junos,cve-2026-102182,">
  <rule id="100401" level="15">
    <decoded_as>json</decoded_as>
    <field name="process.name">kmd</field>
    <field name="event.outcome">malformed</field>
    <description>CVE-2026-102182: Malformed IKE certificate parsed by kmd on Juniper MX (possible exploit attempt)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,rce,</group>
  </rule>

  <rule id="100402" level="15">
    <decoded_as>syslog</decoded_as>
    <match>kmd</match>
    <regex>crash|core|segfault|panic</regex>
    <description>CVE-2026-102182: kmd crash or core observed on Juniper MX (possible stack overflow exploitation)</description>
    <group>attack,rce,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict IKE/IPsec exposure: limit UDP/500 and UDP/4500 access to trusted peer IPs via stateless firewall filters on the MX Series platform.
   • Disable IKE/IKE certificate processing on MX devices where IPsec is not operationally required.
   • Apply management-plane and control-plane protection policies so only known IKE peers can reach kmd.
   • Enable logging and alerting on kmd restarts/crashes; monitor for unexpected process terminations indicating an exploitation attempt.
   • Segment management and control-plane networks so an exploited edge device cannot trivially pivot to internal infrastructure.

2. Patch / upgrade steps

   • No patch evidence is currently tracked. Engage Juniper Networks support and the Juniper Security Advisories page directly to obtain the vendor's fixed release for the MX Series Junos OS lines listed under Affected Versions (21.2R3-S11, 21.4R3-S12, 22.2R3-S8, 22.3R3-S5, 22.4R3-S9 and later recommended thresholds).
   • Once an official fixed build is published, upgrade all affected MX Series devices in priority order (internet-facing and IKE/IPsec-enabled devices first).
   • Validate the applied fix by confirming the Junos version post-upgrade and re-testing IKE connectivity.

3. Long-term hardening

   • Maintain a Junos OS version inventory and subscribe to Juniper SIRT advisories and CISA alerts.
   • Enforce inbound IKE peer allow-listing as a standing control on all edge routers.
   • Deploy continuous monitoring for control-plane daemon crashes (kmd, routing daemons) as a proxy indicator for memory-corruption exploitation.
   • Implement out-of-band management to avoid relying on affected data-plane services for administration.
   • Adopt compensating controls (IDS rules above) until vendor patches are confirmed and deployed.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102182
• CWE-121 (Stack-based Buffer Overflow): https://cwe.mitre.org/data/definitions/121.html
• Juniper Networks Security Advisories: https://supportportal.juniper.net/s/topic/0TO4X0000001TUZWA2/security-advisories
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-102182 not currently listed as of this report)

No public PoC, exploit code, Nuclei template, or known exploit-in-the-wild evidence is available for CVE-2026-102182 at the time of writing. No threat actor campaign has been attributed. The EPSS score is not yet published by FIRST.org.