CVE-2026-21913 is a vulnerability classified under CWE-1419 (Incorrect Initialization of Resource) found in the Internal Device Manager (IDM) component of Juniper Networks Junos OS running on EX4000-48T, EX4000-48P, and EX4000-48MP switch models. The flaw arises from improper resource initialization that can be triggered by an unauthenticated attacker sending a high volume of network traffic destined to the device. This causes the FXPC (Flexible Packet Control) process to crash and subsequently restart the device, leading to a denial-of-service condition. The device remains unavailable until the automatic reboot completes, causing a complete service outage. The vulnerability affects Junos OS versions starting from 24.4 up to but not including 24.4R2, and versions 25.2 prior to 25.2R1-S2 and 25.2R2. The reboot reason logged is a watchdog panic with a core dump, indicating a forced recovery triggered by the system's internal watchdog timer. Exploitation requires no authentication or user interaction, and the attack vector is purely network-based, making it accessible to remote attackers. Although no exploits have been observed in the wild, the vulnerability's nature and ease of exploitation make it a critical concern for network infrastructure stability.

For European organizations, this vulnerability poses a significant risk to network availability and operational continuity, especially for those using Juniper EX4000 switches in their core or distribution networks. A successful attack can cause prolonged outages affecting critical services, including enterprise communications, data center connectivity, and internet access. This can disrupt business operations, lead to financial losses, and damage reputation. Sectors such as finance, telecommunications, government, and critical infrastructure operators in Europe are particularly vulnerable due to their reliance on stable network infrastructure. The lack of authentication and user interaction requirements increases the attack surface, allowing potentially any external attacker to disrupt services remotely. Additionally, the automatic reboot may cause cascading failures in highly available network architectures if redundancy is not properly configured or if multiple devices are targeted simultaneously.

European organizations should prioritize upgrading affected Junos OS versions to 24.4R2, 25.2R1-S2, 25.2R2, or later where the vulnerability is patched. Until patches are applied, network administrators should implement strict ingress filtering and rate limiting on traffic destined to EX4000 devices to mitigate high-volume traffic floods. Deploying network-based anomaly detection systems to identify unusual traffic patterns targeting these devices can provide early warning. Isolating vulnerable switches from untrusted networks or restricting management interfaces to trusted IP ranges reduces exposure. Regularly monitoring device logs for watchdog panic messages can help detect attempted exploitation. Additionally, organizations should review and test their network redundancy and failover mechanisms to ensure resilience against device restarts. Coordination with Juniper Networks support for guidance and updates is recommended. Finally, incorporating this vulnerability into incident response plans will improve readiness to respond to potential DoS attacks.