Junos OS EUVD-2026-101397

Exploitation requires the target MX Series device to be configured for IKE/IPsec using certificate-based authentication, so that the key management daemon (kmd) processes the malicious certificate-bearing IKE packets; routers without IPsec/IKE or using non-certificate (e.g. pre-shared-key only) configurations are not exposed via this path. No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N), and the attacker only needs network reachability to the IKE service. The primary limiting factor is therefore the non-default dependency on certificate-based IKE configuration rather than any auth or interaction requirement; exact affected version trains should be verified against Juniper JSA112196 due to conflicting version data in the sources.

This is a genuine high-priority vulnerability, not a high-CVSS/low-real-risk case. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity network exploitation with full high impact on confidentiality, integrity and availability (VC:H/VI:H/VA:H), and the description explicitly states code execution as root - the most severe outcome on a core routing platform. Supplemental 4.0 metrics reinforce concern: AU:Y (automatable) suggests the attack could be scripted/scaled, and V:C (concentrated value) reflects that MX Series devices are high-value carrier/enterprise routers. However, several escalation signals are absent: no EPSS score is provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - so current exploitation status is 'no public exploit identified at time of analysis.' The real-world attack surface is also gated by configuration: exploitation is via 'specific IKE certificate-based packets,' meaning the device must be running IKE/IPsec with certificate-based authentication, which is not universal across MX deployments. Net assessment: critical technical severity against a high-value target, patch available, but no confirmed active exploitation yet - prioritize patching of IKE/IPsec-configured MX routers while treating mass exploitation as plausible-but-unproven.

An attacker with network reachability to an MX Series router that terminates IKE/IPsec sessions sends specially crafted certificate-based IKE packets to the key management daemon (kmd), overflowing a stack buffer. Because kmd runs with root privileges, successful exploitation yields arbitrary code execution as root without any authentication or user interaction. No public exploit code is referenced, so this currently requires attacker-developed tooling.