Junos OS iked CVE-2026-57024

Exploitation requires three concurrent conditions: (1) the target device must be a Juniper MX with SPC3 or SRX Series running Junos OS in a vulnerable version range; (2) the device must be configured for VPN service with the iked process active - operators can confirm this with 'show system processes extensive | match IKED'; and (3) a large number of VPN negotiation failures must occur, either organically (misconfigured peers over time) or induced by an attacker flooding the device with rejected IKE attempts over an extended period. Systems using the kmd daemon instead of iked are not affected. Exploitation is limited by the need for sustained, high-volume failed negotiations to reach index rollover; a one-time burst is unlikely to trigger the condition. Deployments where IKE access is restricted to known peer IPs via firewall policy face meaningfully reduced exposure since the attacker's ability to inject failing negotiations is curtailed.

The vendor-assigned CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) uses Availability:Low, which appears understated given that recovery explicitly requires a full system reboot - not merely restarting a process. An independent assessment placing A:H is more reflective of actual operational impact. The attack is network-accessible with no authentication required and low complexity for the trigger mechanism itself, though achieving index rollover requires sustained effort over time (many failed negotiations), which adds a practical barrier. No KEV listing and no published POC reduce the immediate threat posture. EPSS data was not provided in the intelligence. The primary risk applies to service providers and enterprises with Juniper MX/SRX VPN gateways where iked is the active daemon, particularly if those gateways are internet-facing and accept IKE from untrusted peers. Internal-only VPN deployments with strict peer allowlisting face lower exposure. The vendor's note that the index value cannot be monitored directly introduces an operational blind spot, meaning operators may not detect the condition until service degrades.

An unauthenticated attacker on the internet sends a sustained flood of malformed or intentionally rejected IKE negotiation attempts to UDP/500 on an internet-facing SRX or MX-SPC3 gateway running iked. Over an extended period, the volume of failed negotiations exhausts the peer index pool, causing a rollover. At rollover, iked begins crashing in a loop as duplicate index values corrupt internal peer state, taking down all VPN services and forcing an operator to schedule an emergency system reboot - a significant disruption for organizations depending on the gateway for remote access or site-to-site connectivity.