Junos OS SRX CVE-2026-57021

Exploitation requires the target SRX Series device to be configured with remote-access VPN AND the pre-logon compliance check feature specifically enabled - this is a non-default configuration that must be deliberately provisioned. Devices running Junos OS on non-SRX platforms are not affected. The CVSS PR:N metric confirms no authentication is required once a target with this configuration is identified. Exploitation is limited to Junos OS versions in the six affected branches (23.2, 23.4, 24.2, 24.4, 25.2, 25.4) prior to the respective fixed releases. The impact is bounded to DoS of http-gk-dependent services (J-Web, VPN, firewall authentication) with no privilege escalation or data exposure possible via this vector. Devices without remote-access VPN or without pre-logon compliance check configured are not exploitable by this specific vulnerability.

The CVSS 3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L accurately captures the core risk profile: network-reachable, zero-complexity exploit with no authentication requirement, but impact is limited to temporary availability loss with no confidentiality or integrity exposure. The AC:L assignment from the vendor is defensible for the attack mechanics themselves, though it is worth noting that successful exploitation requires a non-default configuration (pre-logon compliance check), which effectively limits the exposed population. EPSS data was not provided in available intelligence; however, the narrow exploitation condition and DoS-only impact suggest real-world prioritization should be medium rather than urgent. No active exploitation is confirmed in CISA KEV, and no public POC has been identified. The primary real-world risk is service disruption to security-critical infrastructure: an attacker able to crash VPN and J-Web on a perimeter SRX could blind administrators and block remote workforce access during an incident, making this more impactful in context than the raw CVSS score implies. The process auto-restart mitigates sustained outage only if the attacker does not continuously re-trigger the crash.

An unauthenticated external attacker identifies an SRX Series firewall exposing its remote-access VPN endpoint with pre-logon compliance check enabled, then sends a crafted HTTP request sequence designed to trigger the out-of-bounds write in http-gk. The daemon crashes, immediately terminating J-Web, remote-access VPN sessions, and firewall authentication for all users; the attacker can repeat the trigger request each time the process auto-restarts to maintain a continuous denial of service, blocking remote workforce access and administrative management of the firewall during the disruption period.