Juniper Junos OS: Denial of service in SRX UTM WebFiltering
Summary
An improper resource locking flaw in the UTM processing of Junos OS on Juniper SRX Series firewalls allows an unauthenticated, network-based attacker to crash the UTM process. The UTM subsystem then restarts, causing a complete service outage until recovery. The flaw only applies when UTM WebFiltering (NGWF or EWF) is configured and the WebFiltering cloud server is unreachable, and it is triggered by sustained HTTP traffic load. Juniper rates it CVSS v4.0 8.2 (High) with impact on availability only.
Affected
- Junos OS on SRX Series 23.2R2 before 23.2R2-S7.7
- Junos OS on SRX Series 23.4R2 before 23.4R2-S8.13
- Junos OS on SRX Series 24.2 before 24.2R2-S5.5
- Junos OS on SRX Series 24.4 before 24.4R2-S4
- Junos OS on SRX Series 25.2 before 25.2R2-S1
- Junos OS on SRX Series 25.4 before 25.4R1-S3 and 25.4R2
Fixed in
- 23.2R2-S7.7
- 23.4R2-S8.13
- 24.2R2-S5.5
- 24.4R2-S4
- 25.2R2-S1
- 25.4R1-S3 and 25.4R2
- 26.2R1 and all later releases
Workaround
- No known workarounds according to Juniper.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- No CISA KEV entry found. EPSS is about 0.31 percent.
Our recommendation
- Check on each SRX device whether UTM WebFiltering (NGWF or EWF) is enabled.
- Inventory all SRX devices and their Junos OS versions.
- Upgrade to a fixed release in the next maintenance window, or sooner if WebFiltering is in use and the cloud service has been unreliable.
- Review the other October 2026 Junos OS and SRX bulletins at the same time.
- Monitor for unexpected UTM process restarts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112174 supportportal.juniper.net
- Juniper Security Bulletin October 2026 (WebFiltering) supportportal.juniper.net
- VulnCheck VULNRICHMENT entry CVE-2026-102083 vulners.com
- OpenCVE CVE-2026-102083 app.opencve.io
- Strix CVE-2026-102083 www.strix.ai
- GovCERT.HK alert 2112 www.govcert.gov.hk
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:22.
Original description (NVD)
An Improper Resource Locking vulnerability in the UTM processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When UTM WebFiltering is configured and the WebFiltering cloud server is unreachable, sustained HTTP traffic load may cause the UTM subsystem to crash and restart, which will lead to a complete service outage until the system has recovered. When category lookup requests cannot be completed, they accumulate internally. Under high load and specific timing conditions, an invalid internal state can occur during cleanup of pending WebFiltering lookups, resulting in a crash of the UTM process. This issue applies to both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF). This issue affects Junos OS on SRX Series: * 23.2 versions from 23.2R2 before 23.2R2-S7.7; * 23.4 versions from 23.4R2 before 23.4R2-S8.13; * 24.2 versions before 24.2R2-S5.5; * 24.4 versions before 24.4R2-S4; * 25.2 versions before 25.2R2-S1; * 25.4 versions before 25.4R1-S3, 25.4R2.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.