EUVD-2026-21086
GHSA-9p4v-567m-9ggg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend authentication packet mismatching configured packet-type
-
ExploitTrigger memory leak in bbe-smgd daemon
-
ExecutionExhaust all available memory
-
ImpactDeny service to new subscribers
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | Juniper Networks Junos OS MX Series with BroadBand Edge subscriber management daemon (bbe-smgd) where authentication packet-type option is configured. Adjacent unauthenticated attacker sends packets not matching configured packet type, causing memory leak until bbe-smgd exhaustion prevents new subscriber logins. |
| Impact | Memory leak in subscriber management daemon enables unauthenticated adjacent DoS via malformed authentication packets. CVSS 7.1 reflects high availability impact when heap exhaustion blocks new logins. Wide version range affected (22.4 through 25.2). Requires network adjacency, limiting blast radius to directly connected networks. Moderate severity for operators with authentication packet filtering enabled. |
| Exploit ScenarioDerived | Adjacent attacker sends crafted packets that don't match configured authentication packet-type, triggering memory leak in bbe-smgd. Repeated transmission exhausts daemon heap memory, preventing subscriber authentication and causing service unavailability. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Memory exhaustion in Juniper Networks Junos OS BroadBand Edge subscriber management daemon (bbe-smgd) on MX Series allows adjacent unauthenticated attackers to trigger persistent denial of service by sending authentication packets that do not match configured packet-type options. Each mismatched packet leaks memory, eventually consuming all available daemon heap memory and preventing new subscriber logins. Authentication packet-type configuration must be active for exploitation. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patches: upgrade Junos OS to 22.4R3-S8, 23.2R2-S5, 23.4R2-S6, 24.2R2-S2, 24.4R2, or 25.2R2 depending on installed branch. Workaround: remove authentication packet-type configuration from bbe-smgd if operationally feasible to eliminate leak trigger condition. Monitor daemon memory consumption using 'show system processes extensive | match bbe-smgd' to detect exploitation attempts. Review adjacent network access controls to limit attacker proximity to vulnerable interfaces. Full vendor advisory with affected version matrix: https://kb.juniper.net/JSA107821
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-401 memory leak occurs in bbe-smgd when authentication packet-type filtering is enabled and incoming packets fail type validation. Each rejected packet allocates memory that is never released, progressively exhausting daemon heap until resource limit triggers SMD_DPROF_RSMON_ERROR. Adjacent network access (AV:A) required; exploit does not require authentication credentials (PR:N).
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/RE:M
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).
If the authentication packet-type option is configured and a received packet does not match that packet type, the memory leak occurs. When all memory
available to bbe-smgd has been consumed, no new subscribers will be able to login.
The memory utilization of bbe-smgd can be monitored with the following show command:
user@host> show system processes extensive | match bbe-smgd
The below log message can be observed when this limit has been reached:
bbesmgd[<PID>]: %DAEMON-3-SMD_DPROF_RSMON_ERROR: Resource unavailability, Reason: Daemon Heap Memory exhaustion
This issue affects Junos OS on MX Series:
- all versions before 22.4R3-S8,
- 23.2 versions before 23.2R2-S5,
- 23.4 versions before 23.4R2-S6,
- 24.2 versions before 24.2R2-S2,
- 24.4 versions before 24.4R2,
- 25.2 versions before 25.2R2.
Executive ViewAI
CVE-2026-33775 affects Juniper Networks Junos OS on MX Series routers, enabling adjacent network attackers to exhaust memory in the subscriber management daemon and prevent legitimate user logins through crafted authentication packets. This vulnerability directly impacts network availability and subscriber access, requiring immediate attention for any organization operating MX Series edge routers in production environments.
Apply vendor patch. If immediate patching is not feasible: (1) Restrict network access to bbe-smgd from untrusted adjacent networks using ACLs; (2) Disable authentication packet-type configuration if operationally viable; (3) Implement memory monitoring and automated daemon restart policies; (4) Monitor bbe-smgd process heap utilization for early warning of exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB