VulnerabilityPublished 15 Jan 2026

CVE-2026-21913: Juniper Networks Junos OS · Incorrect Initialization of Resource

Affects Juniper Networks Junos OSSource CVE Database V5

Not known to be exploited · CVSS 7.5 High : upgrade to 25.2R1-S2 or 24.4R2 soon.

Data as of 26 Oct 2026, 10:12 UTC

CVSS 3.1 base score

7.5High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.4% chance of exploitation in 30 days – higher than 34% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 25.2R1-S2, 24.4R2

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 15 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Juniper Networks Junos OS to 25.2R1-S2 or 24.4R2.

Affected software

Product	Affected	Fixed in
Juniper NetworksJunos OS	Affected >=24.4 <24.4R2 =25.2	Fixed in 25.2R1-S2 24.4R2

AI-suggested

Immediate deployment of Juniper-released patches or updates that address this vulnerability is the primary mitigation step. Organizations should verify and upgrade to Junos OS versions 24.4R2, 25.2R1-S2, 25.2R2, or later where the issue is resolved.
Implement strict ingress and egress traffic filtering on network segments hosting EX4000 devices to limit exposure to high-volume traffic floods, especially from untrusted or external sources.
Use rate limiting and anomaly detection on network traffic to identify and block suspicious traffic patterns that could trigger the FXPC crash.
Segment critical network infrastructure to reduce the blast radius of potential attacks and isolate vulnerable devices from public-facing networks.
Monitor device logs and chassis routing-engine outputs for reboot reason codes indicating watchdog panics or crashes to detect exploitation attempts early.
Establish incident response playbooks specific to network device DoS events to minimize downtime and expedite recovery.
Engage with Juniper support for guidance and consider deploying additional redundancy or failover mechanisms to maintain network availability during potential attacks or maintenance.

Description

CVE-2026-21913 is a high-severity vulnerability in Juniper Networks Junos OS affecting EX4000-48T, EX4000-48P, and EX4000-48MP models. It involves incorrect initialization of resources in the Internal Device Manager (IDM), allowing unauthenticated, network-based attackers to trigger a denial-of-service (DoS) by sending a high volume of traffic. This causes the FXPC component to crash and restart, resulting in a complete service outage until reboot. The issue affects Junos OS versions 24.4 before 24.4R2 and 25.2 before 25.2R1-S2 and 25.2R2. No user interaction or authentication is required, and the attack surface is network-exposed.

Impact

For European organizations using Juniper EX4000-48 series switches running vulnerable Junos OS versions, this vulnerability poses a significant risk of network disruption through denial-of-service attacks. The ability for unauthenticated attackers to remotely cause device crashes can lead to prolonged outages of critical network infrastructure, impacting business continuity, especially in sectors relying heavily on stable network connectivity such as finance, telecommunications, healthcare, and government. The outage could disrupt internal communications, data flows, and external connectivity, potentially affecting service level agreements and regulatory compliance. Additionally, the downtime required for device reboot may delay incident response and recovery. Given the network-exposed nature of the vulnerability, attackers could exploit this from outside the organization’s perimeter if devices are reachable, increasing the attack surface. The lack of confidentiality or integrity impact limits data breach risks but availability loss alone can have severe operational and financial consequences.

CWE-1419Incorrect Initialization of Resource (opens in a new tab)
Class weakness
The product attempts to initialize a resource but does not correctly do so, which might leave the resource in an unexpected, incorrect, or insecure state when it is accessed.
Implementation
Choose the safest-possible initialization for security-related resources.
Implementation
Ensure that each resource (whether variable, memory buffer, register, etc.) is fully initialized.
Implementation
Pay close attention to complex conditionals or reset sources that affect initialization, since some paths might not perform the initialization.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 22 Jan 2026, 21:38 UTC

WeaknessesCWE-1419

Technical details

References

Community reviews

Related threats