CVE-2026-102084

Name of the Vulnerable Software and Affected Versions Junos OS on SRX Series versions prior to 23.2R2-S7.7 Junos OS on SRX Series versions 23.4 through 23.4R2-S7 Junos OS on SRX Series versions 24.2 through 24.2R2-S4 Junos OS on SRX Series versions 24.4 through 24.4R2-S3 Junos OS on SRX Series versions 25.2 through 25.2R2 Junos OS on SRX Series versions 25.4 through 25.4R1-S3

Description An improper validation of syntactic correctness of input in the VPN daemon allows an authenticated, network-based attacker to gain complete control of the device. When a device configured for AutoDiscovery VPN (ADVPN) receives a message from a peer containing specifically malformed attributes, it triggers a buffer overflow. This condition can lead to remote code execution. Execution of this attack requires the attacker to have compromised an existing peer or acquired the shared secret to impersonate one.

Recommendations Update to version 23.2R2-S7.7 or later. Update to version 23.4R2-S7 or later. Update to version 24.2R2-S4 or later. Update to version 24.4R2-S3 or later. Update to version 25.2R2 or later. Update to version 25.4R1-S3 or later.