EUVD-2026-42724
GHSA-h62j-crg6-gvwf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X
Network-based unauthenticated bypass with scope change to downstream systems; confidentiality low as filtered traffic reaches previously blocked resources; no integrity or availability impact confirmed.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass web filtering and access downstream resources that should be unreachable.
If an MX Series device is configured with web filtering, and an attacker sends a request with a specifically formatted URL, this request will get forwarded despite the system being configured to block it. In turn, an attacker can access downstream resources that are expected to be unreachable.
This issue affects Junos OS on MX Series:
- all versions before 23.2R2-S7,
- 23.4 versions before 23.4R2-S8,
- 24.2 versions before 24.2R2-S5,
- 24.4 versions before 24.4R2-S4,
- 25.2 versions before 25.2R2-S1,
- 25.4 versions before 25.4R1-S2, 25.4R2.
AnalysisAI
Web filtering bypass on Juniper Networks Junos OS MX Series exposes downstream resources to unauthenticated network attackers by allowing a specially formatted URL to evade the URL filtering plugin. The flaw stems from incorrect name or reference resolution (CWE-706), causing the router to forward traffic that security policy mandates be dropped. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 6.9 carries an Automatable:Yes modifier, indicating the bypass is scriptable at scale against any qualifying deployment.
Technical ContextAI
CWE-706 (Use of Incorrectly-Resolved Name or Reference) indicates the URL filtering plugin within Junos OS fails to correctly canonicalize or parse URLs bearing specific formatting, causing the security enforcement logic to act on a misresolved reference rather than the intended destination. The MX Series is Juniper's carrier-grade multi-service edge router, widely deployed by service providers and large enterprises; the URL filtering feature is an optional but commonly used module that applies policy-based allow/block decisions to HTTP/HTTPS traffic transiting the device. The affected product is captured by CPE cpe:2.3:a:juniper_networks:junos_os across all major Junos OS release trains on the MX platform. Because the flaw lives in the filtering plugin rather than the routing engine itself, the router continues operating normally - only the enforcement of web policy is undermined.
RemediationAI
Upgrade Junos OS on MX Series to the vendor-confirmed fixed versions: 23.2R2-S7 or later, 23.4R2-S8 or later, 24.2R2-S5 or later, 24.4R2-S4 or later, 25.2R2-S1 or later, or 25.4R1-S2 / 25.4R2 or later, as specified in Juniper advisory JSA110093 (https://supportportal.juniper.net/JSA110093). As a compensating control pending patching, disabling the URL filtering feature on the MX Series device will eliminate the attack surface entirely, though this removes all URL-based policy enforcement and may violate compliance or acceptable-use requirements - the trade-off must be weighed against the downstream resources at risk. Alternatively, deploy a separate dedicated web proxy or next-generation firewall inline to enforce URL policy during the remediation window, accepting the added latency and management overhead. Restricting network access to the MX device so that only trusted hosts can route traffic through it reduces the attacker population but does not eliminate the vulnerability if internal threat actors are a concern.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthen
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-ba
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls l
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exh
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker t
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2)
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauth
Out-of-bounds write in the Juniper Networks Junos OS http-gatekeeper (http-gk) process on SRX Series firewalls crashes t
Repeated IKE negotiation failures on Juniper Junos OS (MX with SPC3 and SRX Series) cause a peer index rollover that ass
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved on EX Series, QFX Series, and MX Series allows a loc
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today