Juniper Junos OS Critical Flaw Allows Root Access via BGP Neighbor
A stack-based buffer overflow in Juniper’s routing daemon lets external BGP neighbors execute commands with root privileges, according to NVD records.
Key points
- CVE-2026-33796 carries a CVSS score of 9.8 or 9.3, rated Critical.
- The flaw exists in the routing protocol daemon of Junos OS and Junos OS Evolved.
- Attackers can exploit the vulnerability through BMP route monitoring from a configured external BGP neighbor.
Juniper Networks faces a critical security vulnerability in its Junos OS and Junos OS Evolved software that allows remote attackers to gain root privileges. The National Vulnerability Database (NVD) records identify the flaw as CVE-2026-33796, noting it enables arbitrary command execution through the routing protocol daemon. This issue stems from a stack-based buffer overflow weakness, classified under CWE-121.
At a glance
- CVE
- CVE-2026-33796
- Product
- Juniper Networks Junos OS
- CVSS
- 9.8 Critical
- Weakness
- stack-based buffer overflow
- Exploited
- No known exploitation
According to the NVD records, the vulnerability allows a configured external Border Gateway Protocol (BGP) neighbor to execute arbitrary commands with root privileges. The attack vector specifically utilizes Border Gateway Protocol Monitoring (BMP) route monitoring. The NVD lists two CVSS scores for this single CVE: 9.8 and 9.3, both rated as Critical severity. This indicates a high potential for severe impact if exploited by an authorized external peer.
Context and Background
The vulnerability resides within the routing protocol daemon, known as rpd, which is a core component of Juniper’s network operating systems. The NVD description specifies that the stack-based buffer overflow occurs when the system processes data via BMP route monitoring. This mechanism is designed to provide visibility into BGP routing information, but the flaw turns it into an attack surface.
The NVD records do not specify the date of discovery or the initial disclosure timeline. They also do not mention any threat actors currently exploiting the vulnerability in the wild. The records strictly define the technical mechanics: a buffer overflow in rpd allows command execution. The dual CVSS scores of 9.8 and 9.3 suggest varying assessments of the exact impact scope, but both confirm the critical nature of the defect.
Who Is Affected
Multiple versions of Juniper Networks Junos OS are affected by CVE-2026-33796. The NVD lists specific release trains that remain vulnerable. These include Junos OS versions prior to 23.2R2-S7.7, prior to 23.4R2-S8.13, prior to 24.2R2-S5.5, and prior to 24.4R2-S5. Any installation running an earlier version in these branches is considered at risk according to the advisory data.
Juniper Networks Junos OS Evolved is also impacted across several release lines. The affected versions include those before 23.2R2-S7.7-EVO, before 23.4R2-S8.11-EVO, before 24.2R2-S5.6-EVO, and before 24.4R2-S5-EVO. Organizations using these specific software iterations must verify their current version against this list. The NVD records do not mention any other Juniper products or non-Junos platforms in this specific advisory.
What should you do?
No fix has been confirmed yet in the provided source material. The NVD records only list the affected versions and the technical description of the flaw. They do not announce a patch release, a mitigation guide, or a workaround. Security professionals should monitor official Juniper Networks channels for an update. Until a vendor-provided update is available, exposure remains high for systems running the listed vulnerable versions.
What to do and how to stay safe: Juniper Networks
- Verify if your Junos OS or Junos OS Evolved version matches the affected lists in the NVD record.
- Review BGP neighbor configurations to assess if any external peers could be leveraged for BMP monitoring attacks.
- Monitor network logs for unusual command executions or privilege escalation attempts on routing daemons.
- Await an official patch or mitigation guidance from Juniper Networks before applying unverified workarounds.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-33796?
The NVD records list two CVSS scores for this vulnerability: 9.8 and 9.3, both rated as Critical.
Which Juniper products are affected by this vulnerability?
Juniper Networks Junos OS and Junos OS Evolved are affected, specifically versions prior to the listed secure releases.
How can an attacker exploit this flaw?
An attacker can exploit the stack-based buffer overflow via BMP route monitoring from a configured external BGP neighbor.
