Junos OS (SRX firewalls)
CVE-2026-101936: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is enabled
A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces.
Published Juniper Networks advisory JSA112186
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (SRX Series) 0 | 23.2R2-S7.7 or later |
| Junos OS (SRX Series) 23.4 | 23.4R2-S8.13 or later |
| Junos OS (SRX Series) 24.2 | 24.2R2-S5.5 or later |
| Junos OS (SRX Series) 24.4 | 24.4R2-S5 or later |
| Junos OS (SRX Series) 25.2 | 25.2R2-S2 or later |
| Junos OS (SRX Series) 25.4 | 25.4R1-S3 or later |
| Junos OS (SRX Series) 26.2 | 26.2R1-S2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
A reachable assertion flaw in the srxpfe process of Junos OS on SRX Series firewalls allows an attacker on an adjacent network to trigger a denial of service. By sending malformed firewall-authentication synchronization traffic over chassis-cluster fabric interfaces, the attacker can crash the data plane without needing to log in or interact with users.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces.
Am I affected?
This issue requires chassis-cluster to be configured. For example:
[ interfaces fab0 fabric-options member-interfaces <interface 1> ] [ interfaces fab1 fabric-options member-interfaces <interface 2> ]
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.