CVE-2026-57024
Juniper Junos ≤ 23.2
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-57024 is a medium-severity Use of Multiple Resources with Duplicate Identifier (CWE-694) vulnerability in Juniper Junos. Its CVSS base score is 6.9 (Medium).
Operationally, ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-4 (Identifier Management) — see the control section below for these in your framework.
EU & UK References
No EU or UK CSIRT advisories indexed for this CVE.
Vulnerability Data
A Use of Multiple Resources with Duplicate Identifier vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On an MX with…
more
SPC3 and SRX devices configured for VPN service, when a large number of VPN negotiations fail a peer index rollover will eventually occur. As a result, new peers are assigned index values that are already in use and the iked process starts to crash repeatedly. This results in failure to establish new VPN connections and rekeying existing ones. To restore service the system must be rebooted. Please note that the index value can't be monitored, so customers should monitor tunnel up and down events and if a lot of events occur over an extended period of time it becomes likely that this issue occurs. To be exposed to this issue the system needs to run iked (vs. kmd which is not affected), which can be verified with: user@host> show system processes extensive | match "KMD|IKED" This issue affects Junos OS on MX with SPC3, SRX Series: * all versions before 23.2R2-S7, * 23.4 versions before 23.4R2-S6, * 24.2 versions before 24.2R2-S3, * 24.4 versions before 24.4R2-S4, * 25.2 versions before 25.2R1-S1.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V8.4.1V3.5.4V6.8.1V9.2.4
Mitigating Controls (NIST 800-53 r5) AI
Identifier management directly requires authorization and uniqueness controls that stop duplicate resource identifiers from being assigned or used.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Maintaining software/service inventories requires and enforces unique identifiers to avoid collisions.
Managing identities and credentials for users/services/hardware directly requires unique identifiers.
Lifecycle management of assets includes identifier uniqueness as a supporting practice.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect duplicate identifiers before deployment.
Identity management processes that enforce unique identifiers directly prevent duplicate resource IDs.
Secure development lifecycle practices can catch duplicate-ID issues during design and code review.
Secure coding standards can mandate unique identifier generation and validation.
Configuration management ensures unique identifiers are assigned and maintained across resources.