EUVD-2026-101402
GHSA-8g7f-8jqh-v9wr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach GRE tunnel endpoint over network
-
DeliverySend crafted GRE packet
-
ExploitOverflow stack buffer in srxpfe
-
ExecutionExecute injected code as root
-
ImpactDevice compromise or DoS
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target SRX device to have a GRE tunnel configured; the malicious crafted packet must be received on that configured GRE tunnel interface. This non-default configuration requirement is the primary limiting factor - SRX devices without GRE tunnels are not exposed. Within that constraint there are no further barriers: the attack is remote/network-based, unauthenticated (PR:N), and needs no user interaction (UI:N), targeting the srxpfe packet forwarding process directly. |
| Impact | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, with high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H) - consistent with the description's claim of arbitrary code execution as root or denial of service. The one material mitigating signal is embedded in the vector and description rather than the headline score: exploitation is only possible against an SRX device with a configured GRE tunnel, which is a deployment precondition that narrows the exposed population. No EPSS score was provided, so statistical exploitation probability cannot be weighed. The vulnerability is NOT in CISA KEV and no POC is indicated in the supplied data, so despite the critical 9.3 rating there is no evidence of active exploitation or public exploit code at this time. Root-level RCE in a perimeter security appliance makes this a patch-now item where GRE tunnels are deployed, but the GRE-tunnel precondition and absence of any in-the-wild signal mean urgency should be prioritized by actual configuration exposure rather than treating every SRX as imminently exploitable. |
| Exploit ScenarioDerived | An attacker who can route a packet to an SRX device that has a GRE tunnel configured sends a crafted packet to that tunnel endpoint, overflowing a stack buffer in the srxpfe (packet forwarding) process. By controlling the overflow the attacker either executes arbitrary code as root on the firewall or crashes srxpfe to cause a denial of service. No public exploit code is identified in the provided data, so an attacker would need to develop the exploit independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, remote attacker execute code as root or crash the device by sending a crafted packet through a configured GRE tunnel. The only meaningful precondition is that a GRE tunnel must be configured and the malformed packet must arrive on that tunnel interface, so SRX deployments without GRE are not exposed; where GRE is enabled the attack is network-reachable, requires no credentials and no user interaction, and the independent assessment rates the resulting impact as high across confidentiality, integrity and availability. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but vendor patches are available and the configuration-dependent exposure makes rapid triage of GRE-enabled SRX fleets worthwhile.
RemediationAI
Apply the vendor-released Junos OS fixes named in Juniper advisory JSA112186 (https://supportportal.juniper.net/JSA112186): upgrade to 23.2R2-S7.7 or later on the 23.2 train, 23.4R2-S8.13 or later on 23.4, 24.2R2-S5.5 or later on 24.2, 24.4R2-S5 or later on 24.4, 25.2R2-S2 or later on 25.2, 25.4R1-S3 or later on 25.4, and 26.2R1-S2 or later on 26.2. If an immediate upgrade is not feasible, the most effective compensating control is to remove or temporarily disable GRE tunnel configurations on SRX devices that do not strictly require them, since the vulnerable srxpfe code path is only reachable through a configured GRE tunnel; the trade-off is loss of GRE-based transport or overlay connectivity. Where GRE must stay enabled, restrict GRE (IP protocol 47) to trusted peer addresses with an inbound filter so only known tunnel endpoints can deliver traffic to the device, accepting that spoofed source addresses could still bypass a purely address-based filter. Monitor and rate-limit GRE traffic toward the device and watch for srxpfe crashes or restarts as an indicator of attempted exploitation, keeping in mind that these mitigations reduce but do not eliminate exposure and should be treated as temporary until the patched Junos build is installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-121 stack-based buffer overflow in srxpfe, the user-space process on SRX Series platforms that handles packet forwarding and flow processing. When an SRX device has a GRE (Generic Routing Encapsulation) tunnel configured, inbound GRE traffic is decapsulated and parsed by srxpfe; the parsing routine copies attacker-controlled length or payload data into a fixed-size stack buffer without adequate bounds checking, so an oversized crafted packet overwrites adjacent stack memory. Because srxpfe runs with elevated privileges inside Junos OS, successful corruption can be steered toward arbitrary code execution at root level, and even a failed exploitation attempt can terminate the process and interrupt forwarding. The CPE data (cpe:2.3:a:juniper_networks:junos_os) confirms the affected technology stack is Junos OS itself rather than a separate add-on module, and the weakness class matches the reported behavior of a crafted GRE packet reaching the vulnerable code path.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M
Remote unauthenticated packet to a GRE tunnel with no user interaction gives AV:N/AC:L/PR:N/UI:N; root-level code execution yields C:H/I:H/A:H with scope unchanged on the affected device.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet received on a configured GRE tunnel.
Executive ViewAI
Juniper Networks Junos OS on SRX Series devices with GRE tunnels configured are exposed to a critical stack-based buffer overflow that can allow remote code execution as root or a device crash. Only SRX deployments using GRE tunnels are affected, but for those, the exposure is network-reachable and can disrupt network security and availability. Leadership should prioritize identifying and patching GRE-enabled SRX devices because a successful exploit could compromise the perimeter and cause outages.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Stack-based buffer overflow in Juniper Networks Junos OS and Junos OS Evolved BGP flowspec handling allows a configured
Exploit-DB