Which versions of Juniper are affected by CVE-2026-33778?

CVE-2026-33778 is a high-severity denial-of-service vulnerability in Juniper SRX and MX Series firewalls that allows unauthenticated attackers to disable VPN connectivity by crashing IPsec daemons.. A patch is available.

How to fix or mitigate CVE-2026-33778?

Within 24 hours: Identify all SRX/MX Series deployments in production and retrieve vendor patch details from Juniper security advisory. Within 7 days: Apply Juniper-released patch to non-critical or test devices to validate compatibility with your environment. Within 30 days: Develop maintenance windows and apply patch to all production SRX/MX Series devices, prioritizing those handling critical VPN traffic.

Juniper CVE-2026-33778

Q: What is the CVSS score of CVE-2026-33778?

CVE-2026-33778 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-21197 HIGH

Improper Validation of Syntactic Correctness of Input (CWE-1286)

2026-04-09 sirt@juniper.net

GHSA-q559-6pc6-gxfh

Denial Of Service Juniper

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 17:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:59 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

24.2R2-S4,23.2R2-S6,22.4R3-S9

EUVD ID Assigned

Apr 09, 2026 - 22:22 euvd

EUVD-2026-21197

Analysis Generated

Apr 09, 2026 - 22:22 vuln.today

CVE Published

Apr 09, 2026 - 22:16 nvd

HIGH 8.7

DescriptionCVE.org

An Improper Validation of Syntactic Correctness of Input vulnerability in the IPsec library used by kmd and iked of Juniper Networks Junos OS on SRX Series and MX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS).

If an affected device receives a specifically malformed first ISAKMP packet from the initiator, the kmd/iked process will crash and restart, which momentarily prevents new security associations (SAs) for from being established. Repeated exploitation of this vulnerability causes a complete inability to establish new VPN connections.

This issue affects Junos OS on

SRX Series and MX Series:

all versions before 22.4R3-S9,
23.2 version before 23.2R2-S6,
23.4 version before 23.4R2-S7,
24.2 versions before 24.2R2-S4,
24.4 versions before 24.4R2-S3,
25.2 versions before 25.2R1-S2, 25.2R2.

AnalysisAI

Remote denial-of-service in Juniper Networks Junos OS (SRX/MX Series) allows unauthenticated attackers to crash IPsec daemons via malformed ISAKMP packets. Exploiting the improper input validation (CWE-1286) in kmd/iked IPsec library causes process restart, preventing new VPN security association establishment. Repeated attacks create sustained inability to establish VPN connections, severely degrading network connectivity for affected enterprise firewalls and routing platforms. No public exploit identified at time of analysis.

Technical ContextAI

Root cause: IPsec library fails to validate syntactic correctness of first ISAKMP packet from initiator (CWE-1286). Malformed packet triggers kmd/iked process crash in Junos OS IPsec implementation on SRX Series (cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*) and MX Series platforms. Attack vector network-based, requires no authentication (CVSS PR:N), low complexity (AC:L).

RemediationAI

Vendor-released patches available: upgrade to Junos OS 22.4R3-S9, 23.2R2-S6, 23.4R2-S7, 24.2R2-S4, 24.4R2-S3, 25.2R1-S2, or 25.2R2 depending on deployed release track. Prioritize patching internet-facing SRX/MX devices with active IPsec/VPN configurations. No workaround provided; mitigation requires applying vendor patches. Implement network-layer access controls to restrict ISAKMP (UDP 500/4500) traffic to trusted IPsec peers as temporary risk reduction. Review Juniper security bulletin for deployment guidance: https://kb.juniper.net/JSA107868. Validate IPsec functionality post-upgrade and monitor kmd/iked process stability.