This vulnerability (CVE-2026-33778) arises from improper validation of syntactic correctness of input in the IPsec library components (kmd and iked) of Juniper Networks Junos OS on SRX and MX Series devices. When these devices receive a malformed initial ISAKMP packet, the kmd/iked processes crash and restart, causing a denial of service by temporarily preventing new security associations. Repeated exploitation leads to a complete inability to establish new VPN connections. The issue affects all versions before 22.4R3-S9, 23.2 before 23.2R2-S6, 23.4 before 23.4R2-S7, 24.2 before 24.2R2-S4, 24.4 before 24.4R2-S3, and 25.2 before 25.2R1-S2 and 25.2R2. The CVSS v3.1 score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. Juniper manages remediation for this cloud-hosted service, and patches are available.

An unauthenticated attacker can cause a denial of service by sending a malformed ISAKMP packet, crashing the kmd/iked processes and preventing new VPN security associations from being established. This disrupts VPN connectivity on affected Junos OS devices. The impact is limited to availability with no confidentiality or integrity loss reported.

A patch is available for this vulnerability. Since the affected Junos OS is a cloud-hosted service, Juniper Networks manages remediation server-side. Users should ensure their devices are updated to the fixed versions listed (22.4R3-S9 or later, 23.2R2-S6 or later, 23.4R2-S7 or later, 24.2R2-S4 or later, 24.4R2-S3 or later, 25.2R1-S2 or later). Check the vendor advisory for the latest patch and update guidance.