High priorityDisclosed

Advisory · CVE-2026-102174

Stack overflow in SRX IKE daemon lets a VPN client run code as root

A stack-based buffer overflow in the iked IKE key-management daemon of Junos OS on SRX Series lets an authenticated remote-access VPN client execute code with root privileges or deny service via the remote-access VPN authentication and JIMS identity-publishing path. Juniper rates it CVSS 3.1 8.8.

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-102174
CWE-121
Action timing
Immediate
ELI5

Explain it like I’m five

A valid VPN login is the only ticket needed; the IKE daemon's own stack is the prize behind it.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01VPN client authenticates

    An attacker with valid remote-access VPN credentials connects to the SRX.

  2. 02Authentication path abused

    Input through the VPN authentication and JIMS identity-publishing path overflows iked.

  3. 03Root code or denial of service

    The stack overflow executes code with root privileges or disrupts the gateway.

What happened

Juniper disclosed CVE-2026-102174 in its October 2026 security release: a stack-based buffer overflow (CWE-121) in iked on SRX Series. An authenticated remote-access VPN client can trigger it through the remote-access VPN authentication and JIMS identity-publishing path to execute code with root privileges or deny service.

Juniper’s JSA112186 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for iked crashes tied to remote-access VPN authentications and JIMS publishing events.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

VPN gateways concentrate remote trust. Patch SRX remote-access deployments early and review VPN account hygiene.