Junos OS CVE-2026-102082

Exploitation requires that 'ssl-proxy' is explicitly configured on the SRX platform - this is a non-default deployment mode, so devices without SSL proxy are not affected. The fault is reached only during a TLS session-resumption attempt when a specifically malformed TLS message is processed by the SSL plugin. A key limiting factor is that the exact internal timing required to trigger the invalid pointer access is outside the attacker's direct control (reflected as AT:P in the CVSS 4.0 vector), making exploitation probabilistic rather than reliably repeatable. Impact is limited to a temporary, self-recovering PFE crash (traffic-forwarding outage) with no confidentiality or integrity impact. No authentication or user interaction is required (PR:N/UI:N).

This is a genuine but conditional priority. The CVSS 4.0 base score of 8.2 is driven by network vector (AV:N), low attack complexity (AC:L), no privileges (PR:N/unauthenticated), no user interaction (UI:N), and high availability impact to the vulnerable system (VA:H) plus low subsequent-system availability impact (SA:L, reflecting loss of traffic forwarding). Critically, the vector includes AT:P (Attack Requirements: Present), which aligns with the description's statement that 'the exact internal timing to trigger this issue is outside the attacker's direct control' - meaning exploitation is probabilistic rather than deterministic, lowering real-world reliability. No EPSS score, KEV listing, or POC is present in the provided data: exploitation status is no public exploit identified at time of analysis. The impact is a self-recovering PFE crash (temporary DoS, auto-recovery) rather than persistent compromise or code execution (VC:N/VI:N), so this is availability-only. The most important limiting factor not captured by the raw score is that ssl-proxy must be explicitly configured - a non-default condition - so only a subset of SRX deployments are exposed. Net: patch promptly where ssl-proxy is in use, but the AT:P timing dependency and lack of any exploitation evidence make this lower-urgency than the 8.2 alone suggests.

An unauthenticated attacker on a network path to an SRX firewall running ssl-proxy initiates or interacts with a TLS session and, during a session-resumption attempt, sends a specifically malformed TLS message. This triggers an invalid pointer access that crashes the Packet Forwarding Engine, causing a temporary loss of traffic forwarding until the PFE automatically recovers; repeated attempts could be used to induce recurring outages. No public exploit code is identified at time of analysis, and the internal timing needed to trigger the fault is not directly controllable by the attacker.