Juniper Junos OS EUVD-2026-101389

Requires an SRX Series device running Junos OS configured for remote-access VPN with JIMS (Juniper Identity Management Service) identity-publishing enabled, and the attacker must be an authenticated remote-access VPN client (CVSS PR:L) - a valid VPN credential or a controlled enrolled client is the entry gate. The vulnerable code path is specifically the remote-access VPN authentication plus JIMS identity-publishing flow in the iked daemon, so deployments not using remote-access VPN or not integrating JIMS identity publishing are not exposed. Limiting factors: authentication is mandatory (not exploitable pre-auth), it is constrained to the SRX Series platform and the listed Junos OS release trains, and no user interaction (UI:N) is involved on the victim side.

This is a genuinely high-priority flaw by impact but with a meaningful access barrier. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 8.7) confirms network-reachable, low-complexity exploitation with full confidentiality, integrity, and availability loss - consistent with the description's claim of arbitrary code execution as root or denial of service. The critical qualifier is PR:L: exploitation requires an authenticated remote-access VPN client, so this is not a fully unauthenticated internet-wide threat. No EPSS score, KEV listing, or POC is present in the provided data, so there is no evidence of active exploitation or public exploit code at this time. The signals are therefore consistent rather than conflicting: high technical impact, moderate reachability, but a real authentication gate. Priority should be high for organizations running SRX remote-access VPN with JIMS, because a root-level overflow in the IKE daemon of a perimeter security appliance is a severe outcome, and a successful VPN credential or a malicious/compromised VPN client is the only prerequisite. EPSS and KEV absence should not be read as low risk - it reflects a newly published 2026 CVE with no exploitation telemetry yet rather than a confirmed low-risk issue.

An attacker who has obtained valid remote-access VPN credentials (or controls an enrolled VPN client) connects to an SRX Series firewall configured for remote-access VPN with JIMS identity publishing. During the VPN authentication and identity-publishing exchange, the client sends crafted input that overflows a stack buffer in the iked daemon, yielding root-level code execution or crashing the daemon for denial of service. No public exploit code is identified in the available data, so this remains a described but not publicly weaponized vector.