Juniper Junos OS EUVD-2026-101470

Exploitation requires that the UTM Anti-Spam SBL (Spamhaus Block List) inspection feature be explicitly enabled on the SRX device - this is a non-default UTM configuration, which sharply limits the exposed population. The attacker must also be able to deliver a malformed DNS packet into the device's SBL lookup flow, implying a DNS-response spoofing or on-path (MITM) position in the resolution path rather than an arbitrary direct connection to the firewall (reflected by CVSS 4.0 AT:P / Attack Requirements Present). No authentication is required (PR:N) and no user interaction is needed (UI:N). Net limiting factors: feature must be enabled, and the attacker needs the ability to inject/spoof DNS responses observed by the device.

This is a genuinely high-priority flaw, but with meaningful real-world qualifiers. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.2) indicates a network-reachable, unauthenticated path leading to full confidentiality, integrity, and availability loss on the affected system - consistent with the described arbitrary code execution or denial of service. The single most important nuance is AT:P (Attack Requirements: Present), which signals that exploitation is NOT a simple fire-and-forget remote packet against a default box: the attacker must get a malformed DNS packet to the device in the context of Anti-Spam SBL lookups, and the Anti-Spam SBL inspection feature must be enabled. This is a non-default UTM configuration, so the exposed population is a subset of deployed SRX devices. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or weaponization at this time - treat this as a patch-urgently-but-not-emergency item unless your SRX fleet runs UTM Anti-Spam SBL, in which case it rises to top priority. Note a signal gap: KEV, EPSS, and POC data are simply absent from the input (not confirmed negative), so exploitation likelihood cannot be quantified beyond 'no public exploit identified.'

An attacker positioned to influence DNS responses reaching an SRX firewall that has UTM Anti-Spam SBL inspection enabled injects a malformed DNS packet during an SBL blocklist lookup. The crafted response triggers a stack-based buffer overflow in the Anti-Spam SBL parser, letting the unauthenticated remote attacker crash the service (denial of service) or execute arbitrary code on the firewall. No public exploit code is identified at time of analysis, and the AT:P requirement means the attacker needs a suitable position in the DNS resolution path rather than a trivial direct shot.