Junos OS EUVD-2026-101455

Exploitation requires the SRX to be processing DNS traffic with BOTH Security Intelligence (SecIntel) feed matching and DNS Domain Generation Algorithm (DGA) analysis active, and a single flow session must contain multiple DNS queries such that one matches a SecIntel feed while another is sent for DGA analysis - this is not the default SRX configuration. The crash depends on a timing/race window in processing the logging of these asynchronous tasks that the attacker cannot directly control (reflected in CVSS AC:H and AU:Y), which limits reliability and means the issue cannot be triggered deterministically on demand. No authentication or user interaction is needed (PR:N/UI:N), but the non-default feature requirement and uncontrollable timing are the key limiting factors for defenders.

This is a genuine but conditional risk rather than a drop-everything emergency. The CVSS 4.0 score of 8.2 (HIGH) is driven almost entirely by the availability impact (VA:H) of an FPC crash that takes the data plane down, combined with a network, unauthenticated vector (AV:N/PR:N/UI:N). However, the same vector flags AC:H and AU:Y, and the description explicitly states 'The exact timing conditions are outside an attacker's direct control' - this is effectively a race condition between asynchronous SecIntel and DGA logging tasks, not a deterministic, weaponizable crash. No EPSS score, CISA KEV listing, or POC is present in the provided data, so exploitation is neither confirmed in the wild nor demonstrated publicly: no public exploit identified at time of analysis. Exploitation is further gated on a non-default feature combination (SecIntel feed matching plus DNS DGA analysis). Net assessment: a credible availability threat to exposed SRX firewalls running these DNS-security features, but the high attack complexity and lack of reliable triggering lower real-world priority below what the 8.2 alone implies - patch on a normal-to-expedited cycle, prioritizing internet-facing SRX devices with SecIntel/DGA enabled.

An attacker reachable over the network sends DNS traffic through an SRX firewall configured with SecIntel and DNS DGA analysis, crafting a single flow session containing multiple DNS queries so that one matches a SecIntel feed and another is dispatched for DGA analysis. If the asynchronous logging tasks hit the vulnerable timing window, the NULL pointer dereference crashes the FPC, dropping the data plane. Because timing is not attacker-controlled and no POC is published, the attacker likely must sustain traffic to eventually trigger the crash rather than cause it on demand.