{"id":"CVE-2026-101936","state":"PUBLISHED","title":"Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is enabled","description":"A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces.","publishedAt":"2026-10-14T16:40:32.630Z","updatedAt":"2026-10-14T20:15:54.622Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:A/V:C/RE:M","source":"juniper"},"assigner":"juniper","products":["Juniper Networks Junos OS"],"affected":[{"vendor":"Juniper Networks","product":"Junos OS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"23.2R2-S7.7","versionType":"custom"},{"version":"23.4","status":"affected","lessThan":"23.4R2-S8.13","versionType":"custom"},{"version":"24.2","status":"affected","lessThan":"24.2R2-S5.5","versionType":"custom"},{"version":"24.4","status":"affected","lessThan":"24.4R2-S5","versionType":"custom"},{"version":"25.2","status":"affected","lessThan":"25.2R2-S2","versionType":"custom"},{"version":"25.4","status":"affected","lessThan":"25.4R1-S3","versionType":"custom"},{"version":"26.2","status":"affected","lessThan":"26.2R1-S2","versionType":"custom"}],"platforms":["SRX Series"]}],"references":["https://supportportal.juniper.net/JSA112186"],"weaknesses":["CWE-617"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/101xxx/CVE-2026-101936.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-101936","state":"PUBLISHED","datePublished":"2026-10-14T16:40:32.630Z","dateUpdated":"2026-10-14T20:15:54.622Z","assignerShortName":"juniper","assignerOrgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","dateReserved":"2026-09-28T16:20:15.837Z"},"containers":{"cna":{"title":"Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is enabled","descriptions":[{"lang":"en","value":"A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces."}],"affected":[{"vendor":"Juniper Networks","product":"Junos OS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"23.2R2-S7.7","versionType":"custom"},{"version":"23.4","status":"affected","lessThan":"23.4R2-S8.13","versionType":"custom"},{"version":"24.2","status":"affected","lessThan":"24.2R2-S5.5","versionType":"custom"},{"version":"24.4","status":"affected","lessThan":"24.4R2-S5","versionType":"custom"},{"version":"25.2","status":"affected","lessThan":"25.2R2-S2","versionType":"custom"},{"version":"25.4","status":"affected","lessThan":"25.4R1-S3","versionType":"custom"},{"version":"26.2","status":"affected","lessThan":"26.2R1-S2","versionType":"custom"}],"platforms":["SRX Series"]}],"references":[{"url":"https://supportportal.juniper.net/JSA112186","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"YES","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","baseScore":7.1,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:A/V:C/RE:M","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"MODERATE"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-617","description":"CWE-617 Reachable Assertion","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"juniper","orgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","dateUpdated":"2026-10-14T16:40:32.630Z"},"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"This issue requires chassis-cluster to be configured. For example:<br><br><tt>[ interfaces fab0 fabric-options member-interfaces &lt;interface 1&gt; ]<br>[ interfaces fab1 fabric-options member-interfaces &lt;interface 2&gt; ]</tt>\n\n<br>\n\n<br>"}],"value":"This issue requires chassis-cluster to be configured. For example:\n\n[ interfaces fab0 fabric-options member-interfaces <interface 1> ]\n[ interfaces fab1 fabric-options member-interfaces <interface 2> ]"}],"datePublic":"2026-10-14T16:00:00.000Z","exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}],"value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":true,"type":"text/html","value":"The following software releases have been updated to resolve this specific issue:<br>\n<br>\nJunos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.<br><br><b>Note:</b> For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory."}],"value":"The following software releases have been updated to resolve this specific issue:\n\n\n\nJunos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.\n\nNote: For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory."}],"source":{"advisory":"JSA112186","defect":["1953761"],"discovery":"INTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"There are no known workarounds for this issue."}],"value":"There are no known workarounds for this issue."}],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101936","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T20:15:31.148091Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-14T20:15:54.622Z"}}]}}}