CVE-2026-21917

7.5 HIGH

Denial of Service

📋 TL;DR

An unauthenticated attacker can cause a denial-of-service on Juniper SRX Series firewalls by sending specially crafted SSL packets to devices with UTM Web-Filtering enabled. This causes FPC crashes and restarts, disrupting network traffic. Affected systems include SRX Series running specific vulnerable Junos OS versions.

💻 Affected Systems

Products:

• Juniper Networks SRX Series

Versions: Junos OS: 23.2R2-S2 to before 23.2R2-S5, 23.4R2-S1 to before 23.4R2-S5, 24.2 before 24.2R2-S2, 24.4 before 24.4R1-S3 and 24.4R2. Earlier versions also affected but no fix available.

Operating Systems: Junos OS

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when UTM Web-Filtering is configured and enabled on the SRX device

📦 What is this software?

Junos by Juniper

Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...

Learn more about Junos →

Junos by Juniper

Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...

Learn more about Junos →

Junos by Juniper

Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...

Learn more about Junos →

Junos by Juniper

Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...

Learn more about Junos →

Junos by Juniper

Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...

Learn more about Junos →

Junos by Juniper

Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...

Learn more about Junos →

Junos by Juniper

Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...

Learn more about Junos →

Junos by Juniper

Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...

Learn more about Junos →

Junos by Juniper

Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...

Learn more about Junos →

Junos by Juniper

Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...

Learn more about Junos →

Junos by Juniper

Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...

Learn more about Junos →

Junos by Juniper

Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...

Learn more about Junos →

Junos by Juniper

Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...

Learn more about Junos →

Junos by Juniper

Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...

Learn more about Junos →

Junos by Juniper

Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...

Learn more about Junos →

Junos by Juniper

Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...

Learn more about Junos →

Junos by Juniper

Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...

Learn more about Junos →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete network outage as firewall crashes and restarts, disrupting all traffic passing through the device

🟠

Likely Case

Intermittent service disruptions during FPC crash/restart cycles, potentially causing packet loss and connectivity issues

🟢

If Mitigated

Minimal impact if device is not internet-facing and has proper network segmentation

🌐 Internet-Facing: HIGH - Unauthenticated network-based attack means internet-facing SRX devices are directly vulnerable

🏢 Internal Only: MEDIUM - Internal attackers or malware could still exploit this, but requires network access to the SRX device

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW - Unauthenticated network-based attack with specifically malformed SSL packets

Attack requires sending malformed SSL packets to trigger the vulnerability in the Web-Filtering module

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Junos OS: 23.2R2-S5, 23.4R2-S5, 24.2R2-S2, 24.4R1-S3, 24.4R2 and later

Vendor Advisory: https://kb.juniper.net/JSA105996

Restart Required: Yes

Instructions:

1. Download appropriate Junos OS version from Juniper support portal. 2. Backup current configuration. 3. Install update via CLI or J-Web interface. 4. Reboot device to apply changes. 5. Verify version with 'show version' command.

🔧 Temporary Workarounds

Disable UTM Web-Filtering

all

Temporarily disable UTM Web-Filtering feature to prevent exploitation

Copy

set security utm feature-profile web-filtering type juniper-local
delete security utm feature-profile web-filtering

Restrict SSL Traffic

all

Implement firewall rules to restrict SSL traffic to trusted sources only

Copy

set security policies from-zone untrust to-zone trust policy restrict-ssl match source-address any
set security policies from-zone untrust to-zone trust policy restrict-ssl match destination-address any
set security policies from-zone untrust to-zone trust policy restrict-ssl match application junos-https
set security policies from-zone untrust to-zone trust policy restrict-ssl then deny

🧯 If You Can't Patch

• Implement strict network segmentation to limit access to SRX management interfaces
• Deploy intrusion prevention systems (IPS) to detect and block malformed SSL packets

🔍 How to Verify

Check if Vulnerable:

Copy

Check if UTM Web-Filtering is enabled: 'show configuration security utm feature-profile web-filtering' and verify Junos version is in affected range

Check Version:

Copy

show version | match Junos

Verify Fix Applied:

Copy

Run 'show version' to confirm Junos OS version is patched (23.2R2-S5+, 23.4R2-S5+, 24.2R2-S2+, 24.4R1-S3+, or 24.4R2+)

📡 Detection & Monitoring

Log Indicators:

• FPC crash messages in system logs
• Web-filtering module errors
• Unexpected device restarts

Network Indicators:

• Multiple malformed SSL packets to SRX device
• Sudden traffic drops through firewall

SIEM Query:

Copy

source="SRX" AND ("FPC crash" OR "web-filtering" OR "kernel panic")

📊 Metadata

CVE ID: CVE-2026-21917

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-1286

EPSS Score: 0.12% exploit probability (30.9th percentile)

Published: January 15, 2026

Last Updated: January 23, 2026

🔗 References

• https://kb.juniper.net/JSA105996 Vendor Advisory
• https://supportportal.juniper.net/JSA105996 Vendor Advisory

📤 Share & Export

Twitter LinkedIn Reddit Copy Link

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2026-21917, you might also want to check these:

CVE-2025-41719 8.8

A low-privileged remote attacker can corrupt the webserver user storage by sending unsupported chara...

Same vulnerability type (CWE-1286)

CVE-2024-26507 7.8

This vulnerability allows a local attacker to escalate privileges on systems running vulnerable vers...

Same vulnerability type (CWE-1286)

CVE-2021-31987 7.5

CVE-2021-31987 is an input validation vulnerability in Axis Communications products that allows atta...

Same vulnerability type (CWE-1286)