Juniper Junos OS up to 25.2R1-S0 IKE Daemon index denial of service

Summaryinfo

A vulnerability has been found in Juniper Junos OS up to 23.2R2-S6/23.4R2-S5/24.2R2-S2/24.4R2-S3/25.2R1-S0 and classified as critical. This impacts an unknown function of the component IKE Daemon. Performing a manipulation of the argument index results in denial of service. This vulnerability is identified as CVE-2026-57024. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Juniper Junos OS up to 23.2R2-S6/23.4R2-S5/24.2R2-S2/24.4R2-S3/25.2R1-S0. It has been classified as critical. This affects an unknown part of the component IKE Daemon. The manipulation of the argument index with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability. The summary by CVE is:

A Use of Multiple Resources with Duplicate Identifier vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On an MX with SPC3 and SRX devices configured for VPN service, when a large number of VPN negotiations fail a peer index rollover will eventually occur. As a result, new peers are assigned index values that are already in use and the iked process starts to crash repeatedly. This results in failure to establish new VPN connections and rekeying existing ones. To restore service the system must be rebooted. Please note that the index value can't be monitored, so customers should monitor tunnel up and down events and if a lot of events occur over an extended period of time it becomes likely that this issue occurs. To be exposed to this issue the system needs to run iked (vs. kmd which is not affected), which can be verified with: user@host> show system processes extensive | match "KMD|IKED" This issue affects Junos OS on MX with SPC3, SRX Series: * all versions before 23.2R2-S7, * 23.4 versions before 23.4R2-S6, * 24.2 versions before 24.2R2-S3, * 24.4 versions before 24.4R2-S4, * 25.2 versions before 25.2R1-S1.

It is possible to read the advisory at supportportal.juniper.net. This vulnerability is uniquely identified as CVE-2026-57024 since 06/23/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/10/2026). The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 23.2R2-S7, 23.4R2-S6, 24.2R2-S3, 24.4R2-S4 or 25.2R1-S1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS

Version

• 23.2R2-S6
• 23.4R2-S5
• 24.2R2-S2
• 24.4R2-S3
• 25.2R1-S0

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion