Does Junos OS BGP Flaw CVE-2026-33789 Expose Your Routers to Root Access?

The short version

• Unauthenticated attackers can trigger a stack-based buffer overflow via crafted BGP updates.
• Successful exploitation may lead to denial of service or root-level command execution.
• Vulnerability exists in specific versions of Junos OS and Junos OS Evolved.

The details

Juniper Networks Junos OS contains a critical vulnerability identified as CVE-2026-33789. According to the National Vulnerability Database, this flaw carries a CVSS score of 9.8. The issue stems from a stack-based buffer overflow within the routing protocol daemon, known as rpd. This component is present in both standard Junos OS and Junos OS Evolved releases.

An attacker does not need credentials to exploit this weakness. By sending crafted Border Gateway Protocol route updates, they can trigger the overflow. The National Vulnerability Database notes that the BGP Monitoring Protocol must be enabled for the exploit to succeed. When BMP is active, the daemon processes these updates in a way that exposes the buffer flaw.

The context

The vulnerability affects a wide range of Juniper software versions. Standard Junos OS releases prior to 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, and 24.4R2-S5 are vulnerable. Junos OS Evolved versions before 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, and 24.4R2-S5-EVO are also affected. The National Vulnerability Database classifies the weakness under CWE-121. This category covers stack-based buffer overflows, which can allow an attacker to overwrite adjacent memory. In this specific case, the overflow can lead to root-level command execution. It can also cause a denial of service condition on the affected router.

Next steps

Organisations should immediately audit their Juniper infrastructure for the presence of the BGP Monitoring Protocol. If BMP is enabled on any device running a vulnerable version of Junos OS or Junos OS Evolved, the risk is active. Teams must verify their current software versions against the affected lists provided by the National Vulnerability Database. Devices running versions prior to the specified service releases are exposed. Until a patch is confirmed and deployed, consider disabling BMP if it is not strictly required for operational monitoring. This reduces the attack surface for unauthenticated BGP peers.

What defenders should look for

Security operations teams should monitor for unusual BGP update patterns from known peers. Look for sudden spikes in routing table changes or malformed packets. Check system logs for unexpected restarts of the routing protocol daemon. Alert on any process attempting to execute commands outside normal routing functions. If you suspect exploitation, isolate the affected router from the network immediately. Verify the integrity of the root filesystem and check for new user accounts. Review firewall logs for connections from unknown IP addresses during the incident window.

What to do and how to stay safe: Juniper Networks

• Inventory all Juniper devices and check their current OS versions against the affected list.
• Determine if BGP Monitoring Protocol is enabled on any vulnerable routers.
• Disable BMP on affected devices if it is not essential for your monitoring strategy.
• Monitor network traffic for anomalous BGP activity from untrusted peers.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-33789?

The National Vulnerability Database rates CVE-2026-33789 as Critical with a CVSS score of 9.8.

Which Juniper products are affected by this vulnerability?

Juniper Networks Junos OS and Junos OS Evolved are affected, specifically versions prior to the listed service releases.

Is authentication required to exploit this flaw?

No, the National Vulnerability Database states that an unauthenticated BGP peer can exploit this vulnerability.