CVE-2026-57024: Juniper Junos IKE Daemon DoS via Peer Index Rollover

Technical summary

CVE-2026-57024 is a Use of Multiple Resources with Duplicate Identifier (CWE-694) vulnerability in the IKE daemon of Juniper Junos OS. The flaw occurs when peer index allocation exhausts its namespace and wraps around, causing the daemon to assign index values already in use by active peers. This leads to duplicate resource identifiers within iked's internal data structures, triggering repeated process crashes. The vulnerability is specific to deployments running iked (not the legacy kmd daemon) on MX Series routers equipped with SPC3 line cards and SRX Series devices. Exploitation requires network connectivity and multiple failed VPN negotiation attempts; no authentication is needed.

Business impact

Organizations relying on Juniper MX/SRX routers for VPN termination face potential service outages affecting remote access, site-to-site connectivity, and partner integrations. While the CVSS score (5.3 MEDIUM) reflects limited scope, the operational impact is significant: VPN services become unavailable until manual system reboot, which may violate SLAs and disrupt business continuity. The condition requires an extended period of failed negotiations to manifest, providing a window for sustained denial-of-service attacks targeting organizations with high VPN churn or misconfigured peers.

Affected systems

Juniper Junos OS on MX Series routers with SPC3 (Subscriber Processing Card 3) line cards and SRX Series security gateways are affected. The vulnerability impacts multiple release trains: versions before 23.2R2-S7, 23.4 before 23.4R2-S6, 24.2 before 24.2R2-S3, 24.4 before 24.4R2-S4, and 25.2 before 25.2R1-S1. Critical prerequisite: the system must be running the iked daemon rather than the older kmd implementation. Operators can verify daemon selection by executing 'show system processes extensive | match "KMD|IKED"' on the affected device.

Exploitability

Exploitation is network-based and requires no authentication or user interaction. An attacker must send a sustained volume of VPN negotiation packets designed to fail, gradually exhausting the peer index namespace. The exploitation is not instantaneous—it depends on the rate and timing of failed negotiations needed to trigger index rollover. However, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates low attack complexity and no privileges required, meaning any network-adjacent attacker can attempt this. The vulnerability is not currently listed on the CISA KEV catalog, suggesting either limited active exploitation or recent disclosure.

Remediation

Organizations should upgrade Junos OS on affected MX and SRX devices to patched versions as soon as operationally feasible. Verify your current version against the affected ranges and apply the corresponding fix: upgrade to 23.2R2-S7 or later for 23.2 branch, 23.4R2-S6 or later for 23.4, 24.2R2-S3 or later for 24.2, 24.4R2-S4 or later for 24.4, or 25.2R1-S1 or later for 25.2. Until patching is complete, monitor VPN tunnel state transitions for abnormal patterns and implement network segmentation to limit exposure to untrusted peers initiating VPN negotiations.

Patch guidance

Juniper has released security patches in multiple release trains. Identify your device's current Junos version via 'show version' and map it to the affected ranges in the vulnerability description. Plan a maintenance window and consult Juniper's upgrade procedures for MX/SRX platforms. Patches are available in the 23.2R2, 23.4R2, 24.2R2, 24.4R2, and 25.2R1 branches at the specified maintenance release levels or higher. Test patches in a non-production environment first, as IKE daemon restarts may momentarily disrupt active VPN sessions. Verify post-upgrade that iked is running and no crashes appear in system logs.

Detection guidance

Monitor syslog output for repeated iked process restarts or crashes, particularly if correlated with high volumes of failed VPN peer negotiations. Track VPN tunnel state changes (up/down events) using SNMP or syslog; a pattern of frequent tunnel flaps over extended periods may indicate index rollover occurring. Enable detailed IKE logging if supported in your Junos version to capture failed negotiation attempts. Watch for gaps between successful new VPN connections and rekeying events, which may indicate service degradation. Implement alerting on iked restart frequency; normal operations should show minimal daemon crashes.

Why prioritize this

Although rated MEDIUM severity (CVSS 5.3), this vulnerability warrants prioritized patching for organizations heavily dependent on VPN services. The denial-of-service impact is high in operational terms—complete loss of VPN functionality requiring manual reboot—even though the attack requires sustained effort and is not instantaneous. The lack of KEV listing suggests it may not be currently exploited at scale, making patching a lower-urgency window before active exploitation develops. Prioritize based on VPN criticality: high-availability VPN environments should patch immediately; lower-traffic deployments can follow a standard maintenance cadence.

Risk score, explained

The CVSS 5.3 MEDIUM score reflects the attack vector (network), low complexity, lack of authentication requirements, and availability impact (denial of service). The score does not account for the operational severity in VPN-dependent networks. The partial score reflects that the attack requires a sustained condition (high volume of failed negotiations and index rollover) rather than a single packet or one-time action, reducing the 'exploitability in practice' severity. The lack of confidentiality and integrity impact keeps the score in MEDIUM range despite high operational consequences.

Frequently asked questions