CVE-2026-21906
Published: 15 January 2026
Summary
CVE-2026-21906 is a high-severity Improper Handling of Exceptional Conditions (CWE-755) vulnerability in Juniper Junos. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 5.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Provides defined handling (alert and additional actions) for the exceptional condition of audit logging failure.
Supplies a concrete handling action (safe mode) for exceptional conditions, mitigating risks from improper or absent handling that could allow continued attacks.
By preparing users for contingency scenarios, the control promotes proper handling of exceptional conditions instead of default or unsafe behaviors.
An updated contingency plan defines current actions for exceptional conditions, reducing the window for attackers to exploit improper handling leading to system failure.
Procedures ensure proper handling of exceptional conditions to support effective incident response.
Incident response testing confirms proper handling of exceptional conditions to limit exploit impact.
Gives users guidance on incident handling, reducing improper handling of exceptional conditions that could stem from exploited weaknesses.
Enforces structured response to exceptional conditions so the system cannot remain in an unsafe state.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Crafted ICMP packet over GRE triggers PFE crash/restart, directly enabling DoS via application/system exploitation on network device.
NVD Description
An Improper Handling of Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker sending a specific ICMP packet through a GRE tunnel to cause the PFE to…
more
crash and restart. When PowerMode IPsec (PMI) and GRE performance acceleration are enabled and the device receives a specific ICMP packet, a crash occurs in the SRX PFE, resulting in traffic loss. PMI is enabled by default, and GRE performance acceleration can be enabled by running the configuration command shown below. PMI is a mode of operation that provides IPsec performance improvements using Vector Packet Processing. Note that PMI with GRE performance acceleration is only supported on specific SRX platforms. This issue affects Junos OS on the SRX Series: * all versions before 21.4R3-S12, * from 22.4 before 22.4R3-S8, * from 23.2 before 23.2R2-S5, * from 23.4 before 23.4R2-S5, * from 24.2 before 24.2R2-S3, * from 24.4 before 24.4R2-S1, * from 25.2 before 25.2R1-S1, 25.2R2.
Deeper analysisAI
CVE-2026-21906 is an Improper Handling of Exceptional Conditions vulnerability (CWE-755) in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series devices. It affects configurations where PowerMode IPsec (PMI) and GRE performance acceleration are enabled, with PMI enabled by default and providing IPsec performance improvements via Vector Packet Processing. This issue impacts specific SRX platforms and all Junos OS versions prior to 21.4R3-S12, from 22.4 prior to 22.4R3-S8, from 23.2 prior to 23.2R2-S5, from 23.4 prior to 23.4R2-S5, from 24.2 prior to 24.2R2-S3, from 24.4 prior to 24.4R2-S1, from 25.2 prior to 25.2R1-S1 and 25.2R2. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
An unauthenticated network-based attacker can exploit this vulnerability by sending a specific ICMP packet through a GRE tunnel to the affected device, causing the PFE to crash and restart. This results in a temporary loss of traffic forwarding capability on the device.
Juniper's security advisory JSA106005, available at kb.juniper.net/JSA106005 and supportportal.juniper.net/JSA106005, details the affected versions and recommends upgrading to a supported release that addresses the issue, such as 21.4R3-S12 or later fixed versions in the listed branches. Additional documentation on PowerMode IPsec is at juniper.net/documentation/us/en/software/junos/vpn-ipsec/topics/topic-map/security-powermode-ipsec-vpn.html.
Details
- CWE(s)