Junos OS EUVD-2026-101459

Exploitation requires the SRX device to have UTM WebFiltering explicitly configured (either NextGeneration WebFiltering/NGWF or Enhanced WebFiltering/EWF) AND the external WebFiltering cloud categorization server to be unreachable so that category-lookup requests cannot complete and accumulate internally. The attacker must then sustain high HTTP traffic load and hit a specific timing window where cleanup of pending lookups reaches an invalid internal state (reflected as AT:P in the CVSS 4.0 vector). Limiting factors: devices without UTM WebFiltering are not affected at all; the cloud-server-unreachable precondition and the load/timing race make reliable triggering non-trivial, and the system auto-recovers after each crash (R:A) rather than remaining permanently down.

This is a genuine availability risk but not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes an unauthenticated, network-reachable attack, which raises concern, but the VA:H/VC:N/VI:N profile confines impact to availability - no data compromise or code execution. Crucially, exploitation is gated by AT:P (attack requirements present) and the vendor description's 'specific timing conditions' plus the precondition that the WebFiltering cloud server be unreachable, so this is a race/resource-locking crash (CWE-413) rather than a deterministic single-packet kill. No EPSS score was supplied and the CVE is NOT in CISA KEV; no public POC is referenced. There is therefore no evidence of active exploitation - the only reporter is Juniper itself via its own advisory. Net: a real priority for SRX operators running UTM WebFiltering (self-inflicted or attacker-induced outages are plausible), but the hard precondition (cloud server unreachable) and timing dependence make reliable weaponization materially harder than the 8.2 score suggests in isolation. The device also auto-recovers (R:A in the vector), so impact is a recurring crash/restart cycle rather than permanent bricking.

An attacker who can reach an SRX firewall configured with UTM WebFiltering (NGWF or EWF) waits for or induces a condition where the WebFiltering cloud categorization server is unreachable, then drives sustained HTTP traffic through the device. Pending category-lookup requests accumulate and, under high load, trigger an invalid internal state during cleanup, crashing and restarting the UTM process and cutting off filtered traffic until recovery. No public exploit code is referenced, and success depends on hitting the specific load and timing window.