Read the docs
TI-2026-17613 Aliases CVE-2026-21913GHSA-p84c-pfqc-c27p

Junos OS: EX4000: A high volume of traffic destined to the device leads to a crash and restart

Priority MEDIUM 44CWE-1419Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

An Incorrect Initialization of Resource vulnerability in the Internal Device Manager (IDM) of Juniper Networks Junos OS on EX4000 models allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On EX4000 models with 48 ports (EX4000-48T, EX4000-48P, EX4000-48MP) a high volume of traffic destined to the device will cause an FXPC crash and restart, which leads to a complete service outage until the device has automatically restarted. The following reboot reason can be seen in the output of 'show chassis routing-engine' and as a log message:   reason=0x4000002 reason_string=0x4000002:watchdog + panic with core dump This issue affects Junos OS on EX4000-48T, EX4000-48P and EX4000-48MP: * 24.4 versions before 24.4R2, * 25.2 versions before 25.2R1-S2, 25.2R2. This issue does not affect versions before 24.4R1 as the first Junos OS version for the EX4000 models was 24.4R1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00407 35th percentileScored 2026-11-07
Fix Fixed Junos OS (Juniper Networks): 24.4R2, 25.2R1-S2, 25.2R2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JuniperJunos OS24.4 to before 24.4R2; 25.2 to before 25.2R1-S2, 25.2R224.4R2, 25.2R1-S2, 25.2R2Patch availableCNA
  • Junos OS VendorJuniper Affected 24.4 to before 24.4R2; 25.2 to before 25.2R1-S2, 25.2R2 Fixed in 24.4R2, 25.2R1-S2, 25.2R2 Patch available CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:*24.4VulnerableJuniper
cpe:2.3:o:juniper:junos:24.4:r1:*:*:*:*:*:*24.4 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:24.4:r1-s2:*:*:*:*:*:*24.4 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:24.4:r1-s3:*:*:*:*:*:*24.4 r1-s3VulnerableJuniper
cpe:2.3:o:juniper:junos:25.2:-:*:*:*:*:*:*25.2VulnerableJuniper
cpe:2.3:o:juniper:junos:25.2:r1:*:*:*:*:*:*25.2 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:25.2:r1-s1:*:*:*:*:*:*25.2 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:25.2:r2:*:*:*:*:*:*25.2 r2VulnerableJuniper
cpe:2.3:h:juniper:ex4000-48mp:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:ex4000-48p:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
  • cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:* Versions 24.4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.4:r1:*:*:*:*:*:* Versions 24.4 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.4:r1-s2:*:*:*:*:*:* Versions 24.4 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.4:r1-s3:*:*:*:*:*:* Versions 24.4 r1-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:25.2:-:*:*:*:*:*:* Versions 25.2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:25.2:r1:*:*:*:*:*:* Versions 25.2 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:25.2:r1-s1:*:*:*:*:*:* Versions 25.2 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:25.2:r2:*:*:*:*:*:* Versions 25.2 r2 Vulnerable ·Juniper
  • cpe:2.3:h:juniper:ex4000-48mp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:ex4000-48p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:juniper:ex4000-48t:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
  • cpe:2.3:h:juniper:ex4000-48t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper

Remediation

  • Fix · CNA Junos OS (Juniper Networks) Fixed in 24.4R2, 25.2R1-S2, 25.2R2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-21913
  2. 2026-10-03 Alias added: GHSA-p84c-pfqc-c27p

References

Advisory 2

  • TI-2023-18638 Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01585 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
  • TI-2025-15550 Junos OS: An local attacker with shell access can execute arbitrary code KEVCVSS 4.0MEDIUM 6.7
  • TI-2023-18644 Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files KEVCVSS 3.1MEDIUM 5.3
  • TI-2023-18640 Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files KEVCVSS 3.1MEDIUM 5.3
See all 792 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences