Alert Type

PSN - Product Support Notification
MediumThe additional fix for TSB103739 [juniper.net] will be available in 22.4R3-S9.3.
MediumThe

Product Affected

The following Junos platforms using a VM Host system running Junos Software version 22.4R3-S9.3 are impacted: ACX Series: ACX5448. EX Series: EX9200s. MX Series: - MX240, MX480, MX960 (specifically units with NGREs such as RE-S-X6-*; older RE-1800s are not affected). - MX304 - MX2008, MX2010, MX2020. - MX10003, MX10004, MX10008. PTX Series: - PTX3000, PTX5000 (RE-PTX-X8). - PTX1000s, PTX10002-60C. - PTX10008, PTX10016 (Junos version only; Junos Evolved is not applicable). QFX Series: QFX10002-60C SRX Series: SRX4600 and SRX5800s.

Alert Description

Due to the risk described in TSB103739 [juniper.net] for Junos software version 22.4R3-S9.3, the VMHost images for the affected platforms have been removed from our software download site. The new 22.4R3-S9.4 with the fix was posted on 2026-02-27 for most platforms. Images for PTX platforms will be posted at a later time. The additional fix is being tracked via PR1924890

The Issue

There is a risk of encountering TSB103739 [juniper.net] when upgrading or downgrading to 22.4R3-S8 or 22.4R3-S9. If you recently upgraded to these images, you need to verify that the fix described in TSB103739 [juniper.net] is persistent.

This issue does not apply to you if you are installing Junos OS from a USB flash drive by rebooting and reformatting the system drive.

Without the fix, after March 5, 2026, TLS connections to the vmhost will stop working - resulting in devices failing to boot.

 

Junos Selective Update (JSU) feasible

Yes

Call to Action

If you recently upgraded routers to 22.4R3-S8 or 22.4R3-S9, you need to read TSB103739 [juniper.net] and verify if the fix is persistent.

If the fix is not there, use the instructions in the TSB103739 [juniper.net] to apply the fix to affected routers. 

Related PRs

1911820

1924890

Solution

The "/etc/pki/libvirt/servercert.pem" certificate's validity for 22.4R3-S8 and 22.4R3-S9 will expire on March 5th, 2026.

        Validity

            Not Before: Mar  5 18:57:37 2025 GMT

            Not After : Mar  5 18:57:37 2026 GMT

If you recently upgraded a device to 22.4R3-S8, or 22.4R3-S9, you need to read TSB103739 [juniper.net] to verify if the fix is persistent.

If the fix is not there, use the instructions in the TSB103739 [juniper.net] to apply the fix to affected routers. 

Modification History

2026-02-27 Update to include the release of 22.4R3-S9.4 - replacing 22.4R3-S9.3

First publication 2026-02-12