Junos OS MX Series CVE-2026-57054

Exploitation requires that the target MX Series device has the web filtering feature explicitly configured and active - devices not running web filtering are entirely unaffected by this vulnerability. The attacker must be able to route traffic through the MX Series device (i.e., the device must sit in the network path between the attacker and the targeted downstream resource). No authentication, elevated privileges, or user interaction are required once these structural prerequisites are met. Exploitation is bounded to environments where Junos OS web filtering on MX Series enforces the relevant URL policy; organizations enforcing URL-based controls via dedicated proxies, next-generation firewalls, or other platforms are not exposed to this specific flaw. The CVSS 4.0 PR:N and AC:L metrics confirm that no special attacker positioning or authentication context is needed beyond basic network reachability through the affected device.

The CVSS 4.0 base score of 6.9 from Juniper's vector (AV:N/AC:L/AT:N/PR:N/UI:N) signals low-complexity, network-accessible exploitation requiring no authentication or user interaction, and the AU:Y (Automatable) supplemental metric confirms scripted mass exploitation is feasible. Impact is scoped entirely to downstream systems (VC:N/VI:N/VA:N; SC:N/SI:L/SA:N), meaning the MX router itself is not compromised - only the policy enforcement it provides is defeated. No CISA KEV listing is present, no EPSS data was provided in the intelligence feed, and no public proof-of-concept has been identified, which moderates immediate exploitation urgency. The practical risk is highly deployment-dependent: organizations relying on MX Series web filtering as a primary security control for separating sensitive internal resources face meaningful exposure, while those using the feature only for supplemental content filtering face a more limited impact. The gap between the medium CVSS score and potential downstream business impact should be evaluated against what resources are downstream of the filter - a bypass that exposes internal APIs or administrative interfaces is materially more serious than one that bypasses category-based content filtering.

An unauthenticated attacker routes an HTTP or HTTPS request through an MX Series edge device that has web filtering enabled and a policy blocking the target destination. By crafting the request URL with specific formatting that triggers the URL filtering plugin's incorrect reference resolution, the attacker causes the filter to misidentify the destination and forward the traffic rather than blocking it, reaching an internal or restricted downstream resource. No public proof-of-concept code has been identified at time of analysis, but the low complexity and automatable nature of the bypass make it straightforward to exploit once the formatting technique is known.