CVE-2026-57024
Juniper Junos ≤ 23.2
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:XSummary
CVE-2026-57024 is a medium-severity Use of Multiple Resources with Duplicate Identifier (CWE-694) vulnerability in Juniper Junos. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Service Exhaustion Flood (T1499.002); ranked at the 16th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-7 (Boundary Protection) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
EU & UK References
No EU or UK CSIRT advisories indexed for this CVE.
Vulnerability Data
A Use of Multiple Resources with Duplicate Identifier vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On an MX with…
more
SPC3 and SRX devices configured for VPN service, when a large number of VPN negotiations fail a peer index rollover will eventually occur. As a result, new peers are assigned index values that are already in use and the iked process starts to crash repeatedly. This results in failure to establish new VPN connections and rekeying existing ones. To restore service the system must be rebooted. Please note that the index value can't be monitored, so customers should monitor tunnel up and down events and if a lot of events occur over an extended period of time it becomes likely that this issue occurs. To be exposed to this issue the system needs to run iked (vs. kmd which is not affected), which can be verified with: user@host> show system processes extensive | match "KMD|IKED" This issue affects Junos OS on MX with SPC3, SRX Series: * all versions before 23.2R2-S7, * 23.4 versions before 23.4R2-S6, * 24.2 versions before 24.2R2-S3, * 24.4 versions before 24.4R2-S4, * 25.2 versions before 25.2R1-S1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows an unauthenticated network attacker to trigger repeated crashes of the iked IKE daemon through duplicate peer index assignment after failed VPN negotiations, directly resulting in a service exhaustion condition that prevents new VPN establishment and rekeying.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Boundary protection at the VPN perimeter can rate-limit or filter IKE negotiation attempts, reducing the volume of failed exchanges that trigger peer-index rollover and iked crashes.
Continuous monitoring of VPN tunnel up/down events and IKE daemon health provides early indication of excessive failed negotiations that precede the DoS condition.
Timely application of vendor-supplied patches eliminates the duplicate-index flaw in iked, directly preventing the crash-on-rollover behavior described in the CVE.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Maintaining software/service inventories requires and enforces unique identifiers to avoid collisions.
Managing identities and credentials for users/services/hardware directly requires unique identifiers.
Lifecycle management of assets includes identifier uniqueness as a supporting practice.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect duplicate identifiers before deployment.
Identity management processes that enforce unique identifiers directly prevent duplicate resource IDs.
Secure development lifecycle practices can catch duplicate-ID issues during design and code review.
Secure coding standards can mandate unique identifier generation and validation.
Configuration management ensures unique identifiers are assigned and maintained across resources.