CVE-2026-21906
Juniper Junos ≤ 21.4
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:RedSummary
CVE-2026-21906 is a high-severity Improper Handling of Exceptional Conditions (CWE-755) vulnerability in Juniper Junos. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-24 (Fail in Known State) and SI-17 (Fail-safe Procedures) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-21906 is an Improper Handling of Exceptional Conditions vulnerability (CWE-755) in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series devices. It affects configurations where PowerMode IPsec (PMI) and GRE performance acceleration are enabled, with PMI enabled by default and providing IPsec performance improvements via Vector Packet Processing. This issue impacts specific SRX platforms and all Junos OS versions prior to 21.4R3-S12, from 22.4 prior to 22.4R3-S8, from 23.2 prior to 23.2R2-S5, from 23.4 prior to 23.4R2-S5, from 24.2 prior to 24.2R2-S3, from 24.4 prior to 24.4R2-S1, from 25.2 prior to 25.2R1-S1 and 25.2R2. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
An unauthenticated network-based attacker can exploit this vulnerability by sending a specific ICMP packet through a GRE tunnel to the affected device, causing the PFE to crash and restart. This results in a temporary loss of traffic forwarding capability on the device.
Juniper's security advisory JSA106005, available at kb.juniper.net/JSA106005 and supportportal.juniper.net/JSA106005, details the affected versions and recommends upgrading to a supported release that addresses the issue, such as 21.4R3-S12 or later fixed versions in the listed branches. Additional documentation on PowerMode IPsec is at juniper.net/documentation/us/en/software/junos/vpn-ipsec/topics/topic-map/security-powermode-ipsec-vpn.html.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2698
Vulnerability Data
An Improper Handling of Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker sending a specific ICMP packet through a GRE tunnel to cause the PFE to…
more
crash and restart. When PowerMode IPsec (PMI) and GRE performance acceleration are enabled and the device receives a specific ICMP packet, a crash occurs in the SRX PFE, resulting in traffic loss. PMI is enabled by default, and GRE performance acceleration can be enabled by running the configuration command shown below. PMI is a mode of operation that provides IPsec performance improvements using Vector Packet Processing. Note that PMI with GRE performance acceleration is only supported on specific SRX platforms. This issue affects Junos OS on the SRX Series: * all versions before 21.4R3-S12, * from 22.4 before 22.4R3-S8, * from 23.2 before 23.2R2-S5, * from 23.4 before 23.4R2-S5, * from 24.2 before 24.2R2-S3, * from 24.4 before 24.4R2-S1, * from 25.2 before 25.2R1-S1, 25.2R2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Requires the system to fail to a known safe state on specified failures, limiting the impact of unhandled exceptional conditions.
Mandates explicit fail-safe procedures triggered by indicated failures, structurally preventing unhandled or mishandled exceptional conditions.
Requires generation of appropriate error messages on exceptional conditions, directly enforcing correct handling rather than silent or incorrect behavior.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices explicitly require proper exception and error handling during design and coding.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance verifies correct handling of exceptional conditions.
Documented operating procedures may specify exception handling but do not guarantee implementation.
Logging captures unhandled exceptions, aiding detection but not preventing the weakness.
Monitoring can surface unhandled exceptions but does not enforce proper handling.
Secure SDLC mandates exception-handling requirements and testing that directly prevent improper handling of exceptional conditions.
Application security requirements explicitly include handling of error and exceptional conditions.