Junos Os CVE-2026-33786

CVSS 6.8 with attack vector Local (AV:L), low complexity (AC:L), and low privileges required (PR:L) indicates this is a moderate-to-significant risk confined to authorized or locally-present attackers. The impact is availability-focused (VA:H, SA:L) with no confidentiality or integrity compromise. EPSS and KEV status were not provided in the intelligence data, but the practical risk is elevated by several factors: (1) the attack requires only low privileges and local access, plausible for a compromised user account or physical console access; (2) the vulnerability affects only recent Junos 24.4 branch, suggesting narrow deployment scope but high impact when present; (3) the consequence (complete chassisd restart and momentary traffic loss) is severe for high-availability deployments, particularly in production SRX clusters. Authentication is required (PR:L), limiting exposure to valid system users. This is a real priority for SRX customers running 24.4 pre-patch versions, especially in production environments where availability SLAs are critical.

An authenticated local user with low system privileges (e.g., a standard monitoring account or contractor with console access) executes the specific 'show chassis' CLI command on an SRX device running vulnerable Junos 24.4. The command triggers an unhandled exception in chassisd due to missing validation, causing the daemon to crash and automatically restart. During the restart sequence (typically 30-60 seconds), all chassis modules reload, resulting in a momentary traffic outage and loss of management connectivity until the control plane stabilizes. In a high-availability cluster, this may trigger failover if configured, or cause packet loss if not. No public proof-of-concept code has been identified, but reproduction is straightforward given knowledge of the vulnerable command syntax and local access.