Loading story…
Juniper disclosed two security vulnerabilities affecting Junos OS and Junos OS Evolved, including a local privilege-escalation flaw tracked as CVE-2026-21916 that allows a low-privileged user to escalate privileges and log in as root. The issue creates a path for attackers who already have limited access to gain full administrative control over affected devices, increasing the risk of device takeover and unauthorized configuration changes.
Juniper also published an advisory for CVE-2026-21919, a denial-of-service condition in Junos OS and Junos OS Evolved where a high frequency of connecting and disconnecting NETCONF sessions can cause management-plane unavailability. The flaw can disrupt administrative access and network operations by making device management unavailable, compounding the impact of the privilege-escalation issue for organizations running affected Juniper infrastructure.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Juniper published a security bulletin for CVE-2026-33782 affecting Junos OS on MX Series devices. The bulletin says that in specific DHCPv6 scenarios, jdhcpd memory increases continuously with subscriber logouts.
Juniper published a security bulletin for CVE-2026-33793 affecting Junos OS and Junos OS Evolved, warning that when an unsigned Python op script configuration is present, a local low-privileged user can compromise the system.
Juniper published a security bulletin for CVE-2026-21919 affecting Junos OS and Junos OS Evolved, describing a denial-of-service condition where frequent connection and disconnection of NETCONF sessions can cause management unavailability.
Juniper published a security bulletin for CVE-2026-21916 affecting Junos OS, describing a flaw that could allow a low-privileged user to escalate privileges and log in as root.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Juniper disclosed two vulnerabilities affecting **Junos OS** and **Junos OS Evolved** that allow local attackers to escalate their impact on network devices. One issue, tracked as **`CVE-2026-33788`**, allows an authenticated local attacker on **Junos OS Evolved** to gain access to **Flexible PIC Concentrators (FPCs)**, potentially exposing critical forwarding-plane components to unauthorized access. A second flaw, **`CVE-2026-33793`**, affects **Junos OS** and **Junos OS Evolved** and can let a local low-privileged user compromise the system when an **unsigned Python op script configuration** is present. The advisories indicate that exploitation requires local access and, in the second case, a specific insecure configuration, making the issues especially relevant for organizations that permit shell or operational access on network infrastructure and rely on custom scripting features.
Apr 9, 2026
Juniper disclosed two security vulnerabilities affecting **Junos OS** and **Junos OS Evolved**, including a flaw in **EX Series** and **QFX Series** switches where applying the same egress filter to both an IRB and a physical interface can cause one of the filters not to be enforced. The issue, tracked as **`CVE-2026-33773`**, could undermine intended network policy enforcement by leaving traffic insufficiently filtered on affected deployments. Juniper also published an advisory for **`CVE-2026-33793`**, warning that when an unsigned Python op script configuration is present, a local low-privileged user may be able to compromise the system. The vulnerability affects Junos platforms that permit that configuration state and creates a path for local privilege escalation or broader device compromise, prompting administrators to review exposed systems and apply vendor fixes or mitigations from Juniper's security bulletins.
Apr 9, 2026
Juniper Networks disclosed multiple high-severity vulnerabilities in **Junos OS** and **SRX/MX** platforms, including remotely exploitable denial-of-service flaws and local privilege-escalation issues. The most exposed bugs include **`CVE-2026-33790`**, which lets an unauthenticated attacker crash the `srxpfe` packet forwarding engine on **SRX Series** firewalls by sending a malformed **ICMPv6** packet to devices with **NAT64** enabled, and **`CVE-2026-33778`**, which allows a malformed initial **ISAKMP** packet to crash the `kmd` or `iked` daemons on **SRX** and **MX** systems providing IPsec VPN services. Juniper said repeated exploitation can sustain outages by forcing affected processes into crash loops, and that fixes were released through security bulletins including **`JSA107874`** and **`JSA107868`**. Juniper also fixed **`CVE-2026-33785`**, a missing authorization flaw in **MX Series** routers that allows any locally authenticated user to run privileged `request csds` commands and potentially compromise managed infrastructure in **JDM/CSDS** deployments, and **`CVE-2026-21916`**, a symlink-handling bug in the Junos CLI that can let a low-privileged user gain **root** when another user performs a configuration commit. Affected versions span several supported Junos release trains, with fixes issued on April 8, 2026; some older branches, including certain end-of-life releases, do not have patches. Detection guidance from Juniper and Tenable relies largely on version auditing, configuration review for exposed features such as NAT64 and IPsec, and monitoring for daemon crashes, suspicious `file link` activity, unexpected root access, and abuse of privileged management commands.
Jun 29, 2026