Loading story…
Juniper Networks disclosed multiple high-severity vulnerabilities in Junos OS and SRX/MX platforms, including remotely exploitable denial-of-service flaws and local privilege-escalation issues. The most exposed bugs include CVE-2026-33790, which lets an unauthenticated attacker crash the srxpfe packet forwarding engine on SRX Series firewalls by sending a malformed ICMPv6 packet to devices with NAT64 enabled, and CVE-2026-33778, which allows a malformed initial ISAKMP packet to crash the kmd or iked daemons on SRX and MX systems providing IPsec VPN services. Juniper said repeated exploitation can sustain outages by forcing affected processes into crash loops, and that fixes were released through security bulletins including JSA107874 and JSA107868.
Juniper also fixed CVE-2026-33785, a missing authorization flaw in MX Series routers that allows any locally authenticated user to run privileged request csds commands and potentially compromise managed infrastructure in JDM/CSDS deployments, and CVE-2026-21916, a symlink-handling bug in the Junos CLI that can let a low-privileged user gain root when another user performs a configuration commit. Affected versions span several supported Junos release trains, with fixes issued on April 8, 2026; some older branches, including certain end-of-life releases, do not have patches. Detection guidance from Juniper and Tenable relies largely on version auditing, configuration review for exposed features such as NAT64 and IPsec, and monitoring for daemon crashes, suspicious file link activity, unexpected root access, and abuse of privileged management commands.
See affected versions and whether adversaries are exploiting it.
13 events from the most recent confirmed update back to the earliest known activity.
By 2026-04-09 reporting, Tenable had released version-based Nessus plugins for several newly disclosed Juniper vulnerabilities: plugin 305588 for CVE-2026-33790, 305590 for CVE-2026-33778, 305592 for CVE-2026-33785, and 305598 for CVE-2026-21916. These plugins provided detection coverage for affected Junos deployments.
On 2026-04-08, Juniper released fixes for CVE-2026-33790 across multiple supported Junos OS trains. Juniper also noted that some end-of-life branches, including 21.3 and 22.1, had no patch available.
On 2026-04-08, Juniper published advisory JSA107874 for CVE-2026-33790, a high-severity denial-of-service vulnerability in SRX Series firewalls with NAT64 enabled. A malformed ICMPv6 packet sent to the device can crash and restart the srxpfe packet forwarding engine.
Following Juniper's disclosure of CVE-2026-33785 on 2026-04-08, multiple CERT organizations, including Saudi NCA, Hong Kong CERT, and Norway's JustisCERT, issued urgent alerts recommending immediate patching. Their notices amplified the severity of the MX authorization flaw.
On 2026-04-08, Juniper fixed CVE-2026-33785 in versions 24.4R2-S3, 25.2R2, and 25.4R1. Releases prior to 24.4 were not affected because the vulnerable functionality was introduced in the 24.4 train.
On 2026-04-08, Juniper disclosed CVE-2026-33785, a high-severity missing authorization vulnerability in Junos OS on MX Series routers. The flaw allows any locally authenticated user to execute privileged request csds management commands and, in JDM or CSDS deployments, potentially compromise managed infrastructure behind the router.
When disclosing CVE-2026-33778, Juniper SIRT stated that no malicious exploitation had been observed in the wild, though the issue had been discovered during production usage. This indicated real-world traffic could trigger the crash condition even without confirmed attacks.
On 2026-04-08, Juniper issued security bulletin JSA107868 to fix CVE-2026-33778, a high-severity denial-of-service flaw affecting SRX and MX devices providing IPsec VPN services. A malformed initial ISAKMP packet can crash the kmd or iked daemon and prevent tunnel establishment or rekeying.
On 2026-04-08, Juniper patched CVE-2026-21916, a local privilege escalation flaw in the Junos OS CLI caused by improper symlink handling during configuration commits. The issue allows a low-privileged authenticated user to gain root access when another user performs a commit.
Juniper documented CVE-2025-60004 in advisory JSA103165, describing a critical denial-of-service vulnerability in Junos OS and Junos OS Evolved where malformed BGP EVPN updates can crash the routing protocol daemon. The flaw affects multiple 23.4, 24.2, and 24.4 release trains.
Juniper published a security bulletin and remediation guidance for CVE-2025-59964, a high-severity denial-of-service vulnerability in the SRX4700 Packet Forwarding Engine that can be triggered when forwarding-options sampling is enabled. Repeated traffic can keep the Flexible PIC Concentrator in a crash loop.
Juniper released software updates for CVE-2025-52980, a denial-of-service vulnerability in SRX300 Series devices where crafted BGP UPDATE messages can crash the routing protocol daemon. The issue requires network adjacency and an established BGP session.
Juniper released fixed versions for CVE-2025-52946, a critical use-after-free vulnerability in Junos OS and Junos OS Evolved that can crash the routing protocol daemon via malformed BGP updates when BGP traceoptions are enabled. Administrators were advised to upgrade immediately.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
9 references tracked. Mallory keeps watching after this page renders.
supportportal.juniper.net
Open sourcezeropath.com
Open sourcezeropath.com
Open sourcezeropath.com
Open sourcezeropath.com
Open sourcezeropath.com
Open sourcezeropath.com
Open sourcezeropath.com
Open sourcezeropath.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Juniper Networks has released a comprehensive set of security patches addressing nearly 220 vulnerabilities across its Junos OS, Junos Space, and Security Director products, with a particular focus on nine critical flaws in Junos Space. Among the most severe issues is CVE-2025-59978, a cross-site scripting (XSS) vulnerability in Junos Space that allows attackers to inject malicious scripts into web pages, which are then executed with administrative privileges when viewed by other users. This could enable attackers to gain full control of the system, manipulate configurations, or exfiltrate sensitive data. Another critical flaw, CVE-2025-59974, affects Junos Space Security Director and also involves persistent XSS, enabling attackers to store and execute malicious scripts in the context of other users’ browsers. CVE-2025-59975 describes an uncontrolled resource consumption vulnerability in the HTTP daemon of Junos Space, where an attacker can flood the device with API calls, exhausting system resources and causing a denial of service that blocks both WebUI and CLI management access until a manual reboot is performed. CVE-2025-59968 highlights a missing authorization vulnerability in Junos Space Security Director, allowing unauthenticated attackers to read or modify metadata via the web interface, potentially resulting in managed SRX Series devices permitting unauthorized network traffic and bypassing security policies. Additionally, CVE-2025-11198 in Security Director Policy Enforcer exposes an unrestricted API that could let unauthenticated attackers upload and deploy malicious vSRX images to VMware NSX servers, provided a trusted user initiates deployment, thereby compromising the integrity of virtualized network security appliances. The vulnerabilities affect various versions of Junos Space and Security Director, with patches provided in Junos Space 24.1R4 Patch V1 and other specified updates. Juniper has stated that, as of the time of disclosure, there is no evidence of these vulnerabilities being exploited in the wild. The company strongly recommends that all users apply the latest patches to mitigate the risk of exploitation. The technical nature of these flaws, particularly those affecting administrative and management interfaces, underscores the potential for significant impact, including unauthorized access, denial of service, and compromise of network security controls. The breadth of the vulnerabilities, ranging from XSS to missing authorization and resource exhaustion, highlights the importance of comprehensive patch management and regular security reviews for organizations relying on Juniper’s network management solutions. The patches address not only the critical vulnerabilities but also a wide array of other issues, reflecting Juniper’s ongoing efforts to enhance the security posture of its products. Organizations are urged to review the affected product versions and ensure timely deployment of the recommended updates. Failure to patch could leave critical network infrastructure exposed to remote exploitation, data breaches, and operational disruptions. The coordinated disclosure and patch release demonstrate the importance of vendor transparency and proactive security practices in the face of evolving threats. Security teams should also consider reviewing access controls and monitoring for unusual activity on management interfaces as an additional precaution. The vulnerabilities serve as a reminder of the risks inherent in complex network management platforms and the necessity of maintaining up-to-date defenses.
Jun 29, 2026
Juniper disclosed two security vulnerabilities affecting **Junos OS** and **Junos OS Evolved**, including a local privilege-escalation flaw tracked as **`CVE-2026-21916`** that allows a low-privileged user to escalate privileges and log in as **`root`**. The issue creates a path for attackers who already have limited access to gain full administrative control over affected devices, increasing the risk of device takeover and unauthorized configuration changes. Juniper also published an advisory for **`CVE-2026-21919`**, a denial-of-service condition in **Junos OS** and **Junos OS Evolved** where a high frequency of connecting and disconnecting **NETCONF** sessions can cause management-plane unavailability. The flaw can disrupt administrative access and network operations by making device management unavailable, compounding the impact of the privilege-escalation issue for organizations running affected Juniper infrastructure.
Apr 9, 2026
Juniper disclosed two security vulnerabilities affecting **Junos OS** and **Junos OS Evolved**, including a flaw in **EX Series** and **QFX Series** switches where applying the same egress filter to both an IRB and a physical interface can cause one of the filters not to be enforced. The issue, tracked as **`CVE-2026-33773`**, could undermine intended network policy enforcement by leaving traffic insufficiently filtered on affected deployments. Juniper also published an advisory for **`CVE-2026-33793`**, warning that when an unsigned Python op script configuration is present, a local low-privileged user may be able to compromise the system. The vulnerability affects Junos platforms that permit that configuration state and creates a path for local privilege escalation or broader device compromise, prompting administrators to review exposed systems and apply vendor fixes or mitigations from Juniper's security bulletins.
Apr 9, 2026