CVE-2026-101950 is a critical heap-based buffer overflow in the Secure Vector Routing (SVR) component of Juniper Networks Junos OS on SRX Series devices. An unauthenticated attacker on the network can trigger it with malformed IPv4 packets.
What Is It
CVE-2026-101950 is a heap-based buffer overflow (CWE-122) in the SVR component of Junos OS on SRX Series firewalls. According to Juniper's description, an unauthenticated network attacker can send malformed IPv4 packets to an interface configured for Secure Vector Routing. This can cause a denial of service and may also compromise confidentiality and integrity.
Juniper ([email protected]) published the record on 2026-10-14. Its NVD status is "Received," which means NVD has not finished its own analysis yet.
Why It Matters
Juniper rates the flaw 9.8 CRITICAL under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and 9.3 CRITICAL under CVSS 4.0. The vector means:
- The attack works over the network and is not complex.
- The attacker needs no privileges and no user interaction.
- Confidentiality, integrity and availability impacts are all high.
SRX Series devices usually sit at the network edge, so a packet-triggered memory corruption bug in a routing component can be a serious exposure.
Exploitation status: CVE-2026-101950 has no entry in the CISA Known Exploited Vulnerabilities (KEV) catalog. KEV does not currently confirm active exploitation, and no KEV required action or due date applies.
What's Vulnerable
Junos OS on SRX Series is affected only when an interface is configured for Secure Vector Routing. The affected version ranges are:
- All versions before 23.2R2-S7.7
- 23.4 before 23.4R2-S8.13
- 24.2 before 24.2R2-S5.5
- 24.4 before 24.4R2-S5
- 25.2 before 25.2R2-S2
- 25.4 before 25.4R1-S3
- 26.2 before 26.2R1-S2
Versions outside these ranges are listed as unaffected by default.
Patch Status
The version data shows fixed releases on each affected train:
- 23.2R2-S7.7
- 23.4R2-S8.13
- 24.2R2-S5.5
- 24.4R2-S5
- 25.2R2-S2
- 25.4R1-S3
- 26.2R1-S2
Admins running SRX Series devices with SVR-configured interfaces should upgrade to the fixed release for their train. Juniper advisory JSA112186 has the full remediation guidance. There is no CISA KEV remediation mandate for this CVE at this time.
Sources
- Juniper Networks Security Advisory JSA112186: https://supportportal.juniper.net/JSA112186
- NVD record for CVE-2026-101950: https://nvd.nist.gov/vuln/detail/CVE-2026-101950
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog