Potheeswaran 
Juniper Networks has disclosed a high-severity vulnerability in Junos OS that allows unauthenticated attackers to remotely crash firewall and routing devices using nothing more than a malformed SIP INVITE packet.
Tracked as CVE-2026-57026, the flaw affects MX Series routers equipped with SPC3 cards and the entire SRX Series firewall lineup, putting a substantial chunk of enterprise network infrastructure at risk of sudden service outages.
The vulnerability was published on July 8, 2026, as part of Juniper’s quarterly security bulletin process (JSA110086) and stems from improper validation of syntactic correctness in the SIP Application Layer Gateway (ALG) plugin.
Juniper Junos OS Flaw
The SIP ALG is a feature that inspects and translates Session Initiation Protocol traffic, commonly used for VoIP calls, as it passes through a firewall or router. CVE-2026-57026 exists because the plugin fails to properly validate the structure of incoming SIP invite messages.
When an attacker sends a specifically malformed SIP invite packet to a vulnerable device, the flow processing daemon (flowd), the core process responsible for handling network traffic, crashes and restarts.
During this restart window, the device experiences a complete service outage, disrupting all traffic passing through it until recovery completes automatically.
Critically, no authentication or user interaction is required. An attacker only needs network access to a device with SIP ALG enabled.
Juniper rates this issue as High severity, with a CVSS v3.1 score of 7.5 and a CVSS v4.0 score of 8.7, reflecting the ease of exploitation (low attack complexity, no privileges needed) combined with the significant availability impact of a full flowd crash.
Juniper’s SIRT noted the issue “was seen during production usage,” suggesting it was identified through real deployment incidents rather than purely theoretical research. However, the company states it is not aware of any malicious exploitation at this time.
Devices are only vulnerable if SIP ALG is active, either by default or through explicit configuration. Administrators can check exposure with:
user@host> show security alg status | match sip
SIP : EnabledAffected Versions and Fixes
The vulnerability affects all Junos OS versions prior to specific patched releases across multiple branches:
- Versions before 23.2R2-S7
- 23.4 versions before 23.4R2-S8
- 24.2 versions before 24.2R2-S5
- 24.4 versions before 24.4R2-S4
- 25.2 versions before 25.2R2
- 25.4 versions before 25.4R1-S2
Juniper has released fixes in 23.2R2-S7, 23.4R2-S8, 24.2R2-S5, 24.4R2-S4, 25.2R2, 25.4R1-S2, 25.4R2, 26.2R1, and all subsequent builds. The issue is tracked internally as PR1932051.
Mitigation
Juniper confirms there are no true workarounds for organizations that depend on SIP ALG functionality. For those who don’t require it, disabling the feature eliminates the attack surface entirely:
[ security alg sip disable ]Given that SRX Series firewalls sit at network edges and often handle VoIP traffic for enterprise communications, security teams should prioritize patching over relying on the disable-ALG workaround, since many organizations depend on SIP inspection for legitimate call routing and NAT traversal.
Network administrators managing MX routers with SPC3 cards should treat this bulletin as a priority patching item, particularly given the pre-authentication, zero-interaction nature of the exploit.
About the Author
