Junos OS SRX EUVD-2026-101488

Exploitation requires the SRX to be deployed in a chassis-cluster (high-availability) configuration, and the attacker must be able to inject malformed firewall-authentication synchronization traffic onto the chassis-cluster fabric interface (fab link) - a logically adjacent position (AV:A), not general network reachability. Standalone (non-clustered) SRX devices and deployments not using firewall-authentication synchronization are not exposed. The primary limiting factor is that cluster fabric links are normally dedicated, private point-to-point interconnects between the two cluster nodes, so an attacker must already have access to that segment; no authentication (PR:N) or user interaction (UI:N) is otherwise needed to crash the srxpfe data plane.

The CVSS 4.0 base score of 7.1 (High) is driven entirely by an availability impact (VA:H) with no confidentiality or integrity effect (VC:N/VI:N), reflecting a pure denial-of-service condition consistent with the CWE-617 Reachable Assertion. The most important mitigating signal is the attack vector: AV:A (Adjacent) means the attacker must reach the chassis-cluster fabric interface rather than the general network, which on SRX deployments is typically a dedicated private link between HA cluster nodes - this substantially narrows the realistic attack surface despite PR:N/AC:L/UI:N indicating no authentication, low complexity, and no user interaction. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization; the 4.0 threat/exploit maturity is unset (E:X). The vector's AU:Y and V:C provenance metrics suggest the issue is considered automatable with concentrated value, but these are supplemental and do not elevate this to an urgent widespread-exploitation priority. Net assessment: a genuine but situational availability risk affecting only chassis-cluster SRX deployments reachable on the fabric link, not a high-CVSS-but-trivial-to-exploit internet-facing flaw.

An attacker positioned on the chassis-cluster fabric interconnect (for example a compromised host or rogue device on the dedicated fabric link, or via a misconfiguration exposing that link) sends malformed firewall-authentication synchronization packets to a clustered SRX node. The malformed traffic triggers a reachable assertion in the srxpfe forwarding process, crashing the data plane and causing a denial of service. No public exploit code is identified at time of analysis, and the adjacent-network requirement means the attacker must already have access to the normally private fabric segment.