Product Affected

These issues affect all versions of Junos OS. Affected platforms: SRX Series. These issues affect all versions of Junos OS Evolved. Affected platforms: SRX Series.
Critical

CVSS: v3.1: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS: v4.0: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/V:C/RE:M/U:Red)

Problem

Multiple vulnerabilities have been resolved in the Juniper Networks Junos OS and Junos OS Evolved on SRX Series. These issues were found during extensive internal product security testing.

 

These issues affect:

Junos OS:

  • All versions before 23.2R2-S7.7;
  • from 23.4 before 23.4R2-S8.13;
  • from 24.2 before 24.2R2-S5.5;
  • from 24.4 before 24.4R2-S5;
  • from 25.2 before 25.2R2-S2;
  • from 25.4 before 25.4R1-S3;
  • from 26.2 before 26.2R1-S2;


Junos OS Evolved:

  • All versions before 23.2R2-S7.7-EVO;
  • from 23.4 before 23.4R2-S8.11-EVO;
  • from 24.2 before 24.2R2-S5.6-EVO;
  • from 24.4 before 24.4R2-S5-EVO;
  • from 25.2 before 25.2R2-S2-EVO;
  • from 25.4 before 25.4R1-S3-EVO;
  • from 26.2 before 26.2R1-S2-EVO;
  • 23.4X100-EVO;
  • from 25.2X100 before 25.2X100-D35-EVO;
  • from 25.4X300 before 25.4X300-D40-EVO;

Note: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

 

Important security issues resolved include:

CVECVSSSummary
CVE-2026-1020378.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used
CVE-2026-1019386.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: SRX Series: An attacker causes a forwarding-plane outage when SVR vector routing is used
CVE-2026-1019376.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is used
CVE-2026-1019366.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
7.1 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:A/V:C/RE:M)		Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is enabled
CVE-2026-337988.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS and Junos OS Evolved: SRX Series: An attacker causes remote code execution when SRX chassis-cluster is enabled
CVE-2026-337929.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS: SRX Series: An attacker causes remote code execution and denial of service when a GRE tunnel is configured
CVE-2026-1019978.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L)		Junos OS: SRX Series: A network-based attacker causes Remote Code Execution when Security Intelligence is used without a tls-profile authentication
CVE-2026-1020628.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L)		Junos OS: SRX Series: An compromised HTTPS feed server can cause remote code execution when Security Intelligence is used
CVE-2026-1019509.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L)		Junos OS: SRX Series: Malformed IPv4 packets cause packet-forwarding process crash when Secure Vector Routing is enabled
CVE-2026-1019558.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L)		Junos OS: SRX Series: Malformed DNS packet causes service disruption when UTM Anti-Spam SBL is used
CVE-2026-1021748.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M)		Junos OS: SRX Series: An authenticated remote-access VPN client causes iked denial of service or root-level code execution when JIMS identity publishing is enabled

 

Juniper SIRT is not aware of any malicious exploitation of these vulnerabilities.

These issues were found during internal product security testing or research.

Solution

The following software releases have been updated to resolve this specific issue:

Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.

Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases.

Note: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

These issues are being tracked as 1953761, 1953762, 1953764, 1953078, 1953149, 1955171, 1956639, 1955172, 1952733, 1953636 and 1951651 which are visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Workaround

There are no known workarounds for all of these issues.

Refer to the specific CVE records for additional details on potential individual workarounds.

 

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History

2026-10-14: Initial Publication

Related Information