Buffer Overflow in Juniper Junos OS VPN Daemon

CVE-2026-102084 is a critical vulnerability affecting the VPN daemon of Juniper Networks Junos OS on SRX Series platforms configured for AutoDiscovery VPN (ADVPN). The vulnerability arises from improper validation of the syntactic correctness of incoming peer messages. When a specifically malformed attribute is processed within these messages, it triggers a buffer overflow condition. An authenticated, network-based attacker - specifically one capable of impersonating a VPN peer through the acquisition of a shared secret - can leverage this flaw to execute arbitrary code with the privileges of the VPN daemon. Successful exploitation results in complete control over the affected SRX device, compromising the security boundary of the network. This vulnerability impacts multiple branches of Junos OS, requiring administrators to apply vendor-supplied patches to restore input validation integrity.

Impact

The impact of this vulnerability is total device compromise, allowing an attacker to intercept traffic, reconfigure security policies, or gain a persistent foothold within the network. Because the SRX Series often serves as the edge or core firewall, the scope includes potential exposure of all proxied network traffic. The requirement for a shared secret makes the attack vector constrained but highly dangerous for organizations with large, distributed VPN environments where peer credentials may be subject to lateral movement or credential theft.

Recommendation

• Patch the affected SRX Series devices immediately to the corrected Junos OS versions: 23.2R2-S7.7, 23.4R2-S7, 24.2R2-S4, 24.4R2-S3, 25.2R2, or 25.4R1-S3.
• Audit VPN peer shared secrets and initiate rotation for all exposed AutoDiscovery VPN (ADVPN) nodes to minimize the risk of unauthorized impersonation.
• Monitor device logs for anomalous VPN daemon crashes or restarts that may indicate failed or iterative exploitation attempts targeting the malformed attribute handling logic.