CVE-2026-57054: Juniper Junos Web Filtering Bypass on MX Series – Patch Guidance

Technical summary

This vulnerability is classified as a Use of Incorrectly-Resolved Name or Reference (CWE-706) in the URL filtering module of Junos OS on MX Series platforms. When an MX device is configured with web filtering policies, the filter logic fails to properly resolve or normalize specific URL formats before comparison against the block list. This allows a specially formatted URL to evade the filter decision engine and be forwarded to its destination. The attacker only requires network-level access to the MX device; no authentication or user interaction is required. The core issue is a logic defect in how the URL filtering plugin handles name resolution, not a cryptographic weakness or memory corruption bug.

Business impact

Web filtering policies exist to enforce organizational security and compliance controls—preventing access to malicious, inappropriate, or non-compliant content. This vulnerability undermines that capability on MX Series routers, which are typically deployed as core or edge network devices. Organizations relying on Junos web filtering may unwittingly allow employee access to restricted sites, malware distribution endpoints, or data exfiltration channels. In regulated industries, this could create compliance audit failures. The impact is primarily integrity-focused (users reaching unintended destinations) rather than data confidentiality or availability, but the reputational and operational risk is non-trivial for enterprises that have built policy around Junos filtering.

Affected systems

Juniper Networks Junos OS on MX Series routers are affected across multiple release branches. Vulnerable versions include all releases prior to 23.2R2-S7, 23.4 versions before 23.4R2-S8, 24.2 versions before 24.2R2-S5, 24.4 versions before 24.4R2-S4, 25.2 versions before 25.2R2-S1, and 25.4 versions before 25.4R1-S2 or 25.4R2. This affects a broad installed base, as the MX Series is Juniper's flagship modular routing platform used in service provider and large enterprise networks. Only organizations explicitly using web filtering on their MX devices are exposed to exploitation, but those organizations are typically security-conscious, making the policy bypass particularly noteworthy.

Exploitability

Exploitation requires only network-level access and no authentication. An attacker crafts a URL with a specific format that the filter fails to correctly resolve and simply sends it to the MX device. The barrier to attack is low: no special tools, no user interaction, and no need for valid credentials. However, the attacker must be on a network path where they can send traffic to the MX device (or through it). The CVSS score of 5.8 reflects the low attack complexity and no authentication requirement, balanced against the integrity impact rather than confidentiality loss. This is neither a trivial nor a critical risk—it is a moderate one that demands attention in environments where filtering is a security cornerstone.

Remediation

Juniper has released patched versions across all affected branches. Organizations should upgrade to: 23.2R2-S7 or later, 23.4R2-S8 or later, 24.2R2-S5 or later, 24.4R2-S4 or later, 25.2R2-S1 or later, or 25.4R1-S2, 25.4R2 or later. Patch timing should be prioritized based on your network architecture, support lifecycle, and change management windows, but this is not an emergency zero-day scenario. Verify with Juniper's security advisory and release notes that your target version is available and supported.

Patch guidance

Before patching, verify your current Junos version and which branch (23.x, 24.x, or 25.x) you operate on, then identify the corresponding minimum patched version from the guidance above. Test the patch in a lab or non-critical environment if possible to confirm URL filtering behavior is preserved. Given that MX Series routers are often critical to traffic forwarding, plan for minimal downtime and have a rollback strategy. Juniper typically allows in-service upgrades, but validate with your hardware configuration. Check your support contract to ensure timely access to releases, and contact Juniper TAC if you are on an end-of-support branch.

Detection guidance

Monitor MX device logs for unusual web filtering policy violations, particularly requests that should have been blocked but were forwarded to downstream resources. If you have visibility into traffic leaving your network, look for unexpected connections to sites that your policy intended to block. Enable enhanced logging on the web filtering plugin if available. Behavioral detection is difficult without knowing the exact URL format attackers will use, so direct monitoring of filter bypass attempts is more useful than signature-based approaches. Network segmentation and application-layer proxies downstream of the MX can provide defense-in-depth if the Junos filter is breached.

Why prioritize this

This vulnerability merits prompt but not emergency action. It directly undermines a security control (web filtering) that organizations have explicitly deployed, affecting integrity of policy enforcement. However, it requires network access, is not actively exploited at scale (not on KEV list), and has a moderate rather than critical CVSS score. Prioritize if you rely heavily on Junos-based filtering for compliance or security policy, or if your MX Series is exposed to untrusted networks. If you have multiple layers of filtering (corporate proxy, DNS filtering, etc.), the risk is lower. Schedule patching in your next planned maintenance window, but do not defer indefinitely.

Risk score, explained

The CVSS 3.1 score of 5.8 (MEDIUM) reflects a network-accessible vulnerability with low attack complexity and no authentication requirement, but limited to integrity impact (policy bypass) rather than confidentiality loss or system availability. The scope is marked as changed, meaning the impact extends to resources outside the vulnerable component (downstream systems). The score appropriately captures a security control circumvention that is meaningful but not catastrophic—attackers gain access to restricted resources, not sensitive data exfiltration or system takeover. In context of your threat model, if web filtering is a critical control, you may consider this higher priority than the base score suggests.

Frequently asked questions