CVE-2026-21920
Juniper Junos 23.4 … 24.4
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:XSummary
CVE-2026-21920 is a high-severity Unchecked Return Value (CWE-252) vulnerability in Juniper Junos. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 36th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-21920 is an Unchecked Return Value vulnerability (CWE-252) in the DNS module of Juniper Networks Junos OS on SRX Series devices. It affects Junos OS versions 23.4 prior to 23.4R2-S5, 24.2 prior to 24.2R2-S1, and 24.4 prior to 24.4R2. The vulnerability does not impact Junos OS versions before 23.4R1. The issue has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting high availability impact with no confidentiality or integrity effects.
An unauthenticated, network-based attacker can exploit this vulnerability by sending a specifically formatted DNS request to an SRX Series device configured for DNS processing. This triggers the flowd process to crash and restart, causing a Denial-of-Service (DoS) condition and temporary service interruption until the process recovers.
Juniper Networks has published security advisory JSA106020, accessible at https://kb.juniper.net/JSA106020 and https://supportportal.juniper.net/JSA106020, which details the affected versions and recommends mitigation by upgrading to patched releases such as 23.4R2-S5, 24.2R2-S1, or 24.4R2.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2685
Vulnerability Data
An Unchecked Return Value vulnerability in the DNS module of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If an SRX Series device configured for DNS processing, receives a specifically formatted…
more
DNS request flowd will crash and restart, which causes a service interruption until the process has recovered. This issue affects Junos OS on SRX Series: * 23.4 versions before 23.4R2-S5, * 24.2 versions before 24.2R2-S1, * 24.4 versions before 24.4R2. This issue does not affect Junos OS versions before 23.4R1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and code evaluation can discover instances where return values are ignored.
Requiring a documented development process and coding standards can mandate explicit checking of all function return values.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require checking and handling all function return values to detect error conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect missing return-value checks.
Secure development life cycle mandates verification of return values to prevent undetected failures.
Application security requirements include input/output validation and error handling that covers return-value checks.
Secure system architecture and engineering principles require robust error handling and defensive coding practices.
Secure coding explicitly requires checking return values to avoid CWE-252.