Junos OS EUVD-2026-101463

Exploitation is limited to SRX4000 Series, SRX5000 Series with SPC3, and MX Series with SPC3 hardware, AND only when at least one of these application services is configured: ALGs, IDP/DPI, APPID, SECINTEL, AAMW, or AppQoE. The attacker must also sustain a high connections-per-second churn to drive the per-session PFE memory leak to exhaustion. Devices without any of these services configured are not exploitable, and the vulnerable software versions are specific (23.4R2-S3 before 23.4R2-S7; 24.2R2 before 24.2R2-S3; 24.4 before 24.4R2-S3; 25.2 before 25.2R1-S2/25.2R2). No authentication or user interaction is required (PR:N/UI:N), so on a correctly-matching, feature-enabled device a remote attacker can trigger the DoS; the service-configuration and hardware requirements are the primary limiting factors.

This is a genuine operational priority for affected Juniper SRX/MX operators, though not a universal drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VA:H) correctly reflects a network-reachable, unauthenticated, availability-only flaw - there is NO confidentiality or integrity impact (VC:N/VI:N), so this is a pure Denial-of-Service via memory leak (CWE-401), not code execution. The vendor-assigned 8.7 (High) is driven entirely by the availability impact to a critical network control plane. Crucially, exploitation is CONDITIONAL: it requires that one or more specific security services (ALGs, IDP/DPI, APPID, SECINTEL, AAMW, or AppQoE) be configured AND that the attacker generate sustained high connections-per-second churn - so despite PR:N, real-world exploitability depends heavily on target configuration, meaning not every SRX/MX in the field is affected. No EPSS score, no KEV listing, and no public POC were provided, so there is no evidence of active exploitation or widespread automated attack - this is reported by the vendor (Juniper) rather than observed in the wild. Net: prioritize patching on devices running the named services, but the absence of KEV/POC and the configuration dependency place this below a weaponized remote-code-execution flaw.

An attacker with network reachability to an SRX4000/SRX5000-SPC3 or MX-SPC3 device that has ALG, IDP/DPI, AppID, SecIntel, AAMW, or AppQoE services enabled generates a sustained high rate of new connections per second. Each connection leaks a small amount of PFE memory that is never released; over time the leak exhausts PFE memory on the FPC, degrading or halting traffic forwarding. No public exploit code was identified, and no authentication or user interaction is required.