EUVD-2026-21085Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
An Incorrect Initialization of Resource vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series and QFX Series device allows an unauthenticated, network-based attacker to cause an integrity impact to downstream networks.
When the same family inet or inet6 filter is applied on an IRB interface and on a physical interface as egress filter on EX4100, EX4400, EX4650 and QFX5120 devices, only one of the two filters will be applied, which can lead to traffic being sent out one of these interfaces which should have been blocked.
This issue affects Junos OS on EX Series and QFX Series:
- 23.4 version 23.4R2-S6,
- 24.2 version 24.2R2-S3.
No other Junos OS versions are affected.
AnalysisAI
Packet forwarding engine (pfe) in Juniper Networks Junos OS on EX4100, EX4400, EX4650, and QFX5120 devices fails to correctly initialize egress filters on IRB and physical interfaces, allowing unauthenticated network-based attackers to bypass security policies and cause integrity impact by forwarding traffic that should be blocked. The vulnerability affects Junos OS versions 23.4R2-S6 and 24.2R2-S3. EPSS score of 6.9 reflects moderate exploitation probability; no active exploitation confirmed (non-KEV status).
Technical ContextAI
The vulnerability exists in the packet forwarding engine's (pfe) filter application logic on specific EX Series (campus Ethernet switches) and QFX Series (core routing platforms) devices. When identical inet or inet6 family filters are configured as egress policies on both an Integrated Routing and Bridging (IRB) interface and a physical interface on the same device, the filter initialization routine fails to apply both filters correctly-only one is enforced. This is classified as CWE-1419 (Incorrect Initialization with Hard-Coded Network Resource Configuration Values), indicating a fundamental resource initialization flaw in the forwarding pipeline. The affected CPE is cpe:2.3:a:juniper_networks:junos_os:*:*:*:*:*:*:*:*, though only specific hardware SKUs (EX4100, EX4400, EX4650, QFX5120) and OS versions exhibit the defect.
RemediationAI
Juniper has released patches for both affected branches: upgrade to Junos OS version 23.4R2-S7 or later for the 23.4 line, or upgrade to version 24.2R2-S4 or later for the 24.2 line. The fundamental fix corrects the packet forwarding engine's filter initialization routine to properly apply egress filters on both IRB and physical interfaces simultaneously. Until patching is possible, operators can mitigate by: (1) applying the same egress filter only on the physical interface (not on the IRB), or (2) ensuring that firewall policy enforcement is redundant at upstream network boundaries or at Layer 3 policy enforcement points. Consult Juniper advisory JSA107815 for the exact patch versions, detailed upgrade procedures, and confirmation that your device hardware SKU is addressed by the released patches.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthen
Memory leak in Juniper Networks Junos OS jdhcpd daemon enables adjacent unauthenticated attackers to crash DHCP services
Local privilege escalation in Juniper Networks Junos OS and Junos OS Evolved allows low-privileged authenticated users t
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-ba
Certificate chain validation bypass in Juniper Junos OS J-Web on SRX Series enables person-in-the-middle attackers to in
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls l
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exh
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker t
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2)
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauth
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today