Loading story…
Juniper disclosed two security vulnerabilities affecting Junos OS and Junos OS Evolved, including a flaw in EX Series and QFX Series switches where applying the same egress filter to both an IRB and a physical interface can cause one of the filters not to be enforced. The issue, tracked as CVE-2026-33773, could undermine intended network policy enforcement by leaving traffic insufficiently filtered on affected deployments.
Juniper also published an advisory for CVE-2026-33793, warning that when an unsigned Python op script configuration is present, a local low-privileged user may be able to compromise the system. The vulnerability affects Junos platforms that permit that configuration state and creates a path for local privilege escalation or broader device compromise, prompting administrators to review exposed systems and apply vendor fixes or mitigations from Juniper's security bulletins.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Juniper published a security bulletin for CVE-2026-33793, describing a vulnerability in Junos OS and Junos OS Evolved where the presence of an unsigned Python op script configuration could allow a local low-privileged user to compromise the system.
Juniper published a security bulletin for CVE-2026-33773, describing an issue in Junos OS EX Series and QFX Series where, if the same egress filter is configured on both an IRB and a physical interface, one of the filters is not applied.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Juniper disclosed two vulnerabilities affecting **Junos OS** and **Junos OS Evolved** that allow local attackers to escalate their impact on network devices. One issue, tracked as **`CVE-2026-33788`**, allows an authenticated local attacker on **Junos OS Evolved** to gain access to **Flexible PIC Concentrators (FPCs)**, potentially exposing critical forwarding-plane components to unauthorized access. A second flaw, **`CVE-2026-33793`**, affects **Junos OS** and **Junos OS Evolved** and can let a local low-privileged user compromise the system when an **unsigned Python op script configuration** is present. The advisories indicate that exploitation requires local access and, in the second case, a specific insecure configuration, making the issues especially relevant for organizations that permit shell or operational access on network infrastructure and rely on custom scripting features.
Apr 9, 2026
Juniper disclosed two security vulnerabilities affecting **Junos OS** and **Junos OS Evolved**, including a local privilege-escalation flaw tracked as **`CVE-2026-21916`** that allows a low-privileged user to escalate privileges and log in as **`root`**. The issue creates a path for attackers who already have limited access to gain full administrative control over affected devices, increasing the risk of device takeover and unauthorized configuration changes. Juniper also published an advisory for **`CVE-2026-21919`**, a denial-of-service condition in **Junos OS** and **Junos OS Evolved** where a high frequency of connecting and disconnecting **NETCONF** sessions can cause management-plane unavailability. The flaw can disrupt administrative access and network operations by making device management unavailable, compounding the impact of the privilege-escalation issue for organizations running affected Juniper infrastructure.
Apr 9, 2026
Juniper Networks disclosed multiple high-severity vulnerabilities in **Junos OS** and **SRX/MX** platforms, including remotely exploitable denial-of-service flaws and local privilege-escalation issues. The most exposed bugs include **`CVE-2026-33790`**, which lets an unauthenticated attacker crash the `srxpfe` packet forwarding engine on **SRX Series** firewalls by sending a malformed **ICMPv6** packet to devices with **NAT64** enabled, and **`CVE-2026-33778`**, which allows a malformed initial **ISAKMP** packet to crash the `kmd` or `iked` daemons on **SRX** and **MX** systems providing IPsec VPN services. Juniper said repeated exploitation can sustain outages by forcing affected processes into crash loops, and that fixes were released through security bulletins including **`JSA107874`** and **`JSA107868`**. Juniper also fixed **`CVE-2026-33785`**, a missing authorization flaw in **MX Series** routers that allows any locally authenticated user to run privileged `request csds` commands and potentially compromise managed infrastructure in **JDM/CSDS** deployments, and **`CVE-2026-21916`**, a symlink-handling bug in the Junos CLI that can let a low-privileged user gain **root** when another user performs a configuration commit. Affected versions span several supported Junos release trains, with fixes issued on April 8, 2026; some older branches, including certain end-of-life releases, do not have patches. Detection guidance from Juniper and Tenable relies largely on version auditing, configuration review for exposed features such as NAT64 and IPsec, and monitoring for daemon crashes, suspicious `file link` activity, unexpected root access, and abuse of privileged management commands.
Jun 29, 2026