CVE-2026-57022: Juniper Junos DoS Vulnerability in MX/SRX Platforms

Technical summary

CVE-2026-57022 is an improper exception handling vulnerability (CWE-754) in the Packet Forwarding Engine of Juniper Junos OS. The vulnerability manifests when an affected device initiates a TCP connection to an attacker-controlled system that responds with a malicious packet crafted to trigger an unhandled condition in the PFE. The crash and automatic restart cycle disrupts all forwarding operations. The vulnerability is particularly relevant in deployments using advanced packet inspection features such as ALG (Application Layer Gateway), SSL proxy, UTM (Unified Threat Management), RTLOG, AppQoE probing, AAMW, ICAP, or URL filtering—all scenarios where devices may establish outbound connections that an attacker could intercept or influence.

Business impact

Organizations running affected Juniper MX or SRX devices will experience service interruptions when the PFE crashes and restarts. The duration of impact depends on system size and recovery time, but full traffic loss is expected during each incident. For data centers or service providers relying on these platforms for core forwarding, even brief outages can cascade into widespread customer impact. Repeated exploitation could enable a denial-of-service attack that exhausts operational staff and damages availability SLAs. The reputational and operational cost of unplanned outages, combined with incident response overhead, elevates business risk even at a CVSS 5.9 (Medium) rating.

Affected systems

All Junos OS versions prior to 23.2R2-S4 are vulnerable, as well as 23.4 versions before 23.4R2-S5 and 24.2 versions before 24.2R2. Affected platforms include MX Series with SPC3 (MX240, MX480, MX960), SRX5k Series with SPC3, and SRX1600, SRX2300, SRX4000 (including SRX4100, SRX4120, SRX4200, SRX4300, SRX4600, SRX4700), SRX5400, SRX5600, SRX5800, and vSRX Series. Any organization operating these models should verify their current Junos version and apply patches immediately.

Exploitability

The attack requires network-based access and does not require authentication, making it remotely exploitable. However, a key constraint is that the affected device must initiate an outbound TCP connection to the attacker-controlled system first. This is not a direct inbound attack vector; it requires either misconfiguration, a compromised internal system, or legitimate outbound communication that an attacker can hijack. The difficulty is rated as 'High' in the CVSS vector (AC:H), reflecting the dependency on triggering conditions. Devices performing URL filtering, SSL inspection, or threat intelligence lookups are at higher risk because such features regularly establish outbound connections. This raises the practical exploitability in networks with aggressive inspection policies.

Remediation

Upgrade Junos OS to a patched version: 23.2R2-S4 or later for the 23.2 branch, 23.4R2-S5 or later for the 23.4 branch, or 24.2R2 or later for the 24.2 branch. Organizations should verify the exact version requirements against the Juniper advisory and test patches in a controlled environment before production deployment. If immediate patching is not feasible, consider restricting outbound connections from the affected platform to trusted systems only, and disable unnecessary inspection features that trigger outbound lookups. Monitor PFE crash logs for indicators of exploitation attempts.

Patch guidance

Juniper has released patched versions across three supported branches. Verify your current Junos version and determine which branch you are on (23.2, 23.4, or 24.2) by consulting your device configuration or running 'show version'. Coordinate patching during a maintenance window to minimize service disruption, as reboots are typically required. Test patches on a representative device in a lab environment first to ensure compatibility with your configuration. Consult the Juniper Networks security advisory for any branch-specific migration guidance or known issues. Document the patch baseline and add it to change management tracking to prevent regression.

Detection guidance

Monitor Packet Forwarding Engine logs for abnormal crash and restart events, particularly when correlated with outbound connection attempts. Enable comprehensive logging for ALG, SSL proxy, UTM, RTLOG, AppQoE, and URL filtering features to capture suspicious activity preceding crashes. Network-based detection is challenging because the attack involves a single malformed response packet; however, anomalous outbound connection failures followed by immediate system restarts may signal an exploitation attempt. Set up alerting on PFE restart events and correlate them with outbound traffic to untrusted or unexpected destinations. Maintain detailed baseline metrics for normal PFE stability to identify deviations.

Why prioritize this

Although rated CVSS 5.9 (Medium), this vulnerability warrants high prioritization due to its impact on critical infrastructure. MX and SRX platforms are core routing and security devices, and any DoS affecting them has organization-wide consequences. The vulnerability affects multiple product lines and versions in broad deployment. The fact that it does not require authentication or privileged access lowers the attacker barrier. Furthermore, organizations with advanced threat inspection and URL filtering—increasingly common in security-conscious deployments—face elevated practical risk. The automatic recovery means repeated exploitation is viable, enabling sustained denial-of-service campaigns. Given the criticality of affected platforms and the wide version range impacted, treat this as a priority-one patch initiative.

Risk score, explained

The CVSS 5.9 score reflects the balance of a high-impact availability loss (complete service disruption during restart) against the high attack complexity requirement (device must initiate outbound connection first). The vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H indicates a network-based, unauthenticated attack with no impact on confidentiality or integrity, only availability. The Medium severity classification underestimates operational risk for organizations running these devices as critical infrastructure. Context-specific risk may be higher for service providers, data centers, or networks with policies that encourage active outbound inspection and threat intelligence feeds.

Frequently asked questions