Juniper Junos OS EUVD-2026-101405

Exploitation requires the SRX device to be deployed in a high-availability chassis cluster, and the attacker must be Layer-2 adjacent to the HA fabric link, able to inject crafted high-availability fabric traffic (per AV:A and the description). The vulnerable component is the srxpfe packet-forwarding process. Key limiting factors: the attack is not remotely reachable over routed networks (adjacent-only), it does not apply to standalone/non-clustered SRX deployments lacking an HA fabric, and it is confined to the affected Junos OS / Junos OS Evolved versions listed in the EUVD data (e.g., below 24.4R2-S5, 25.4R1-S3, 26.2R1-S2 and the corresponding -EVO builds). No authentication or user interaction is required once fabric access is obtained (PR:N/UI:N).

This is a genuinely serious but access-constrained vulnerability. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, score 8.7 High) shows unauthenticated, low-complexity code execution with full confidentiality/integrity/availability impact, which maps to the description's claim of arbitrary code execution as root. The single most important mitigating signal is AV:A (adjacent) combined with the description's specificity: exploitation occurs 'via high-availability fabric traffic,' meaning the attacker must have Layer-2 access to the SRX chassis-cluster fabric link rather than remote internet reachability. No EPSS score was provided, and there is no CISA KEV listing and no public exploit referenced, so there is no public exploit identified at time of analysis. The confluence of root-level RCE on a security appliance with a vendor patch already available makes this a real patching priority for anyone running SRX clusters, but it is not an internet-wide mass-exploitation threat the way an AV:N firewall RCE would be - realistic exposure depends almost entirely on the trust/segmentation of the HA fabric network. Note the provided vector also carries SA:L (subsequent-system availability, low) which is mild; the primary impact is on the affected device itself (SC:N/SI:N).

An attacker with Layer-2 access to the dedicated high-availability fabric link between two clustered Juniper SRX firewalls injects crafted fabric traffic that overflows a stack buffer in the srxpfe forwarding process, gaining arbitrary code execution as root on the firewall. No public exploit code is known, but because the srxpfe process runs as root, successful exploitation yields complete compromise of a core perimeter security device. The adjacency requirement means the attacker must already be positioned on or able to inject into the HA fabric segment.