Junos OS EUVD-2026-101458

The SRX device MUST be configured for AutoDiscovery VPN (ADVPN) - this is a non-default feature, so devices without ADVPN are not affected. Additionally, the attacker must already be a trusted participant in the VPN: either having acquired the ADVPN pre-shared secret to impersonate a peer, or having compromised an existing legitimate peer. These two preconditions (ADVPN enabled + peer trust/PSK possession) are the primary limiting factors and are why the vendor rates attack complexity high (AC:H); they substantially reduce real-world exploitability despite the network attack vector and critical impact. Affected: Junos OS on SRX Series in all versions before 23.2R2-S7.7, 23.4 before 23.4R2-S7, 24.2 before 24.2R2-S4, 24.4 before 24.4R2-S3, 25.2 before 25.2R2, and 25.4 before 25.4R1-S3.

This is a genuinely high-severity issue but NOT a drop-everything emergency, and the raw 9.2 CVSS 4.0 score overstates the realistic threat. The vector (AV:N/AC:H/AT:N/PR:N/UI:N) yields CRITICAL, but the vendor's choice of PR:N conflicts with the description, which explicitly states the attacker must either acquire the pre-shared secret to impersonate a peer or compromise an existing ADVPN peer - a meaningful authentication/trust precondition the vendor instead reflected via AC:H ('considerably difficult'). The impact side is fully justified: VC:H/VI:H/VA:H corresponds to buffer-overflow-driven remote code execution and complete device takeover. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' Net assessment: real priority for any SRX fleet running ADVPN because of the total-compromise impact, but the trust/PSK prerequisite and high attack complexity make opportunistic mass exploitation unlikely; prioritize patching ADVPN-configured SRX devices while treating widespread internet-wide exploitation as improbable absent a POC or KEV entry.

An attacker who has either stolen an ADVPN pre-shared secret or already compromised a legitimate spoke/peer establishes a VPN session to a vulnerable SRX device configured for AutoDiscovery VPN and sends IKE/ADVPN protocol messages containing one or more specifically malformed attributes. The malformed input triggers a buffer overflow in the VPN daemon, yielding remote code execution and complete control of the firewall. No public exploit code is identified in the provided data, and the required peer-trust foothold makes this a targeted rather than spray-and-pray attack.