Juniper SRX Series Faces Critical Unauthenticated Remote Code Execution Flaw
A stack-based buffer overflow in Juniper SRX Series devices allows unauthenticated attackers to execute code as root or cause denial of service via crafted GRE tunnel packets.
Key points
- The vulnerability, tracked as CVE-2026-33792, carries a CVSS score of 9.8 or 9.3 depending on the record.
- Attackers can exploit the flaw by sending crafted packets through a configured GRE tunnel.
- Juniper Networks Junos OS versions prior to specific service releases are affected.
The National Vulnerability Database (NVD) has published records for CVE-2026-33792, a critical security flaw in Juniper Networks equipment. This vulnerability affects the SRX Series security appliances running Junos OS. The issue stems from a stack-based buffer overflow in the srxpfe process. An unauthenticated network attacker can exploit this weakness remotely.
At a glance
- CVE
- CVE-2026-33792
- Product
- Juniper Networks Junos OS
- CVSS
- 9.8 Critical
- Weakness
- stack-based buffer overflow
- Exploited
- No known exploitation
According to the NVD records, the flaw allows an attacker to execute arbitrary code with root privileges. Alternatively, the attacker can cause a denial of service condition. The exploit vector involves sending a crafted packet to a configured GRE tunnel. The vulnerability is classified under CWE-121, which covers stack-based buffer overflows. Two slightly different CVSS scores appear in the source material: 9.8 and 9.3. Both ratings fall within the critical severity range.
Context and Background
The vulnerability resides specifically within the srxpfe process of the Junos operating system. The flaw is triggered when the system processes a specially crafted packet. This packet must be received on a GRE tunnel that has been configured on the device. The presence of a configured GRE tunnel is a prerequisite for exploitation.
The NVD records indicate that the vulnerability is stack-based. This type of buffer overflow occurs when more data is written to a buffer than it can hold. The excess data overwrites adjacent memory locations on the stack. This can lead to code execution or system crashes. The unauthenticated nature of the attack means no login credentials are required. Attackers can target the device from the network directly.
Who Is Affected
Several versions of Juniper Networks Junos OS are affected by this vulnerability. Devices running Junos OS before version 23.2R2-S7.7 are vulnerable. Systems running Junos OS before version 23.4R2-S8.13 are also affected. Additionally, devices running Junos OS before version 24.2R2-S5.5 are at risk. Finally, Junos OS versions before 24.4R2-S5 are susceptible to exploitation.
The source material does not mention a patch, fix, or update. Therefore, no fix has been confirmed yet. Administrators should verify their current Junos OS version against the affected list. If a device runs a version older than the specified service releases, it is exposed. The vulnerability applies to SRX Series hardware specifically. Other Juniper platforms are not mentioned in the NVD records.
What should you do?
Security professionals should immediately audit their Juniper SRX Series deployments. Identify all devices running affected versions of Junos OS. Check for the presence of configured GRE tunnels on these devices. If a device is affected, consider restricting access to the GRE tunnel interface. Monitor logs for unusual traffic patterns or signs of exploitation. Wait for official guidance from Juniper Networks regarding a patch.
What to do and how to stay safe: Juniper Networks
- Inventory all Juniper SRX Series devices and check their Junos OS versions against the affected list.
- Identify which devices have configured GRE tunnels, as these are required for exploitation.
- Monitor network traffic for anomalies on GRE tunnel interfaces that might indicate an attack.
- Restrict inbound traffic to GRE tunnel endpoints if possible until a fix is available.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-33792?
The NVD records list CVSS scores of 9.8 and 9.3, both rated as critical.
How can an attacker exploit this vulnerability?
An unauthenticated attacker can send a crafted packet through a configured GRE tunnel.
Which Juniper products are affected?
Juniper Networks SRX Series devices running specific versions of Junos OS are affected.
