Juniper SRX CVE-2026-101937

Exploitation requires the SRX to be deployed in a chassis-cluster (high-availability) configuration, since the attack surface is specifically chassis-cluster fabric traffic processed by srxpfe; standalone SRX deployments without clustering are not reachable via this path. The attacker must occupy an adjacent position with the ability to send traffic onto the dedicated fabric interconnect between cluster nodes (AV:A), which typically means a compromised peer node or physical/logical access to the fabric link - this is the primary limiting factor and is far more restrictive than general network exposure. No authentication is required once on the fabric (PR:N) and no user interaction is needed (UI:N), and impact is limited to availability (denial of service of the data plane) with no confidentiality or integrity effect.

This is a genuine but access-constrained availability threat, best characterized as moderate rather than critical priority despite the 7.1 base score. The CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N/VA:H) signals an adjacent-network, low-complexity, unauthenticated path to high availability impact, but 'adjacent' here is decisive: the exploitation surface is chassis-cluster fabric traffic, i.e. the dedicated inter-node HA interconnect between SRX devices, not the general network. An attacker must therefore already have a foothold on or be able to inject traffic onto that fabric link, which substantially narrows real-world reach. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization; the signals are consistent (vendor-sourced, availability-only, no integrity/confidentiality impact) with no contradictions. The SSVC-style read is: technical impact is partial-to-total on the data plane, but automatability is low given the privileged network position required, so this warrants scheduled patching for HA SRX deployments rather than emergency response. Note the input provides a CVSS 4.0 vector only - no 4.0 'E' exploit-maturity value is set (E:X), so maturity is formally undefined.

An attacker with access to the chassis-cluster fabric interconnect (for example via a compromised cluster node or direct access to the fabric link between SRX HA peers) sends crafted fabric traffic to the srxpfe forwarding process. The signed-to-unsigned conversion error (CWE-195) mishandles the input and crashes or wedges the data plane, interrupting traffic forwarding. No public exploit code is identified in the provided data, and exploitation requires an adjacent position on the fabric rather than remote internet access.