Junos OS CVE-2026-101950

Exploitation requires the target SRX Series device to have at least one interface explicitly configured for Secure Vector Routing (SVR), and the malformed IPv4 packets must reach that SVR-enabled interface. This non-default feature configuration is the primary limiting factor - devices without SVR configured are not exposed to this flaw. Per the CVSS vector (PR:N/UI:N/AC:L/AT:N), no authentication, user interaction, or special timing is needed once packets reach the SVR interface, so on affected deployments it is remotely triggerable by any network attacker with a path to that interface.

Signals mostly align toward genuine high priority, with important caveats. Juniper's CVSS 4.0 vector (9.3, AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, unauthenticated, low-complexity network attack with high confidentiality, integrity, and availability impact on the vulnerable system (VC:H/VI:H/VA:H), consistent with a CWE-122 heap overflow in a packet-parsing path. However, several exploitation signals are absent from the input: no EPSS score, no CISA KEV listing, and no public POC are provided, so this is 'no public exploit identified at time of analysis' rather than active exploitation. The practical risk is sharply gated by one condition the description states explicitly: the overflow is only reachable on an interface configured for Secure Vector Routing (SVR), which is a specific, non-default feature rather than a baseline SRX configuration - so the 9.3 base score overstates the exposed population. The description also hedges impact ('denial of service and potentially compromise confidentiality and integrity'), so reliable DoS is the confirmed outcome while RCE-grade C/I compromise is presented by the vendor as potential, not demonstrated - treat the high C/I metrics as an upper bound pending a confirmed exploit.

An attacker with network reachability to an SRX Series device that has an interface configured for Secure Vector Routing sends a stream of malformed IPv4 packets to that interface. The SVR component mishandles the packets and overflows a heap buffer, crashing the service (denial of service) and potentially corrupting memory in a way that could affect confidentiality and integrity. No public exploit code is identified at time of analysis, and exploitation requires no authentication or user interaction once the packets reach the SVR-enabled interface.