Key points
- CVE-2026-33789 affects multiple Junos OS and Junos OS Evolved versions through specific service releases.
- The flaw allows unauthenticated remote code execution at the root level via crafted BGP updates.
- Vulnerability requires the BGP Monitoring Protocol to be enabled on the affected device.
Juniper Networks Junos OS and Junos OS Evolved contain a critical stack-based buffer overflow flaw in the routing protocol daemon. This vulnerability, tracked as CVE-2026-33789, permits unauthenticated remote attackers to execute commands with root privileges.
What happened
The National Vulnerability Database records CVE-2026-33789 with a CVSS score of 9.8, classifying it as critical severity. The flaw resides within the routing protocol daemon, specifically identified as rpd. It stems from a stack-based buffer overflow weakness, mapped to CWE-121 in the Common Weakness Enumeration. An unauthenticated Border Gateway Protocol peer can exploit this by sending crafted route updates. This action is possible only when the BGP Monitoring Protocol is enabled on the device. The NVD description notes that this can lead to denial of service or potential root-level command execution.
Why it matters
Organisations running affected versions of Junos OS face significant risk of complete system compromise. The vulnerability allows attackers to gain root-level access without prior authentication. This bypasses standard security controls and grants full control over the networking equipment. The impact is severe because the attack vector is remote and requires no credentials. Systems with BGP Monitoring Protocol enabled are directly exposed to this threat. The critical rating underscores the immediate danger to network infrastructure integrity and availability.
What happens next
Security teams must verify their current Junos OS versions against the vulnerable release list. Affected systems include Junos OS versions prior to 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, and 24.4R2-S5. Junos OS Evolved versions before 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, and 24.4R2-S5-EVO are also impacted. Users should assess whether BGP Monitoring Protocol is active on these devices. If enabled, the risk of exploitation is present until a mitigation or patch is applied.
Patch priority
Organisations should prioritise remediation based on external exposure. Systems directly facing the internet or untrusted networks require immediate attention. Teams usually begin by identifying devices with BGP Monitoring Protocol enabled. Validate the current software version against the vendor advisory. Roll out updates in a controlled manner, starting with non-critical systems. Test the patch in a staging environment before production deployment. Create full system backups prior to any update. Monitor logs for signs of exploitation during the transition. Reduce exposure by disabling unnecessary monitoring features if patching is delayed.
What to do and how to stay safe: Juniper Networks
- Audit all network devices to confirm if BGP Monitoring Protocol is currently enabled.
- Compare installed Junos OS versions against the specific vulnerable release thresholds listed in the advisory.
- Restrict BGP peer connections to trusted sources only, if possible, to limit attack surface.
- Monitor system logs for unusual rpd behaviour or unexpected restarts indicating exploitation attempts.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific Junos OS versions are affected by CVE-2026-33789?
Versions before 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, and 24.4R2-S5 are vulnerable.
Is authentication required to exploit this vulnerability?
No, the vulnerability allows unauthenticated BGP peers to trigger the buffer overflow.
What condition must be met for the flaw to be exploitable?
The BGP Monitoring Protocol must be enabled on the affected device.
