A NULL Pointer Dereference in the pkid component allows an unauthenticated remote attacker to force a server reset by sending a specially crafted packet during certificate enrollment or automatic reenrollment. The flaw results in a clear denial of service, disrupting Junos OS operation without granting any additional privileges. The weakness corresponds to CWE‑476, indicating a failure to validate a null reference before use.

Juniper Networks Junos OS versions 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all subsequent releases are impacted; older respins of 23.2, 23.4, and 24.2 have been rebuilt to address this issue.

The advisory assigns a CVSS score of 8.7, classifying the vulnerability as high severity. EPSS score is <1%, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely over an untrusted network by transmitting a malformed packet during CMP enrollment, requiring no authentication or privileged access. Due to the lack of a technical workaround, devices remain susceptible until the patched releases are deployed.