Junos OS (SRX firewalls)
CVE-2026-101937: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is used
A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic.
Published Juniper Networks advisory JSA112186
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (SRX Series) 0 | 23.2R2-S7.7 or later |
| Junos OS (SRX Series) 23.4 | 23.4R2-S8.13 or later |
| Junos OS (SRX Series) 24.2 | 24.2R2-S5.5 or later |
| Junos OS (SRX Series) 24.4 | 24.4R2-S5 or later |
| Junos OS (SRX Series) 25.2 | 25.2R2-S2 or later |
| Junos OS (SRX Series) 25.4 | 25.4R1-S3 or later |
| Junos OS (SRX Series) 26.2 | 26.2R1-S2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
A signed to unsigned conversion error in the srxpfe component of Junos OS on SRX Series firewalls allows an attacker to trigger a denial of service. By sending specific chassis-cluster fabric traffic from an adjacent network, the attacker can disrupt the data plane without requiring authentication or user interaction.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic.
Am I affected?
This issue requires chassis-cluster to be configured. For example:
[ interfaces fab0 fabric-options member-interfaces <interface 1> ] [ interfaces fab1 fabric-options member-interfaces <interface 2> ]
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.