EUVD-2026-21095
GHSA-fc25-pm3m-2gqh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLog in as low-privileged local user
-
DeliveryCreate malicious unsigned Python op script
-
ExploitExecute op script via UI
-
ExecutionScript runs as root-equivalent user
-
ImpactGain full system compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Unnecessary privilege execution
|
| Exploitation Conditions | Requires Juniper Junos OS (versions before 22.4R3-S7, 23.2 before 23.2R2-S4, 23.4 before 23.4R2-S6, 24.2 before 24.2R1-S2) configured to allow unsigned Python op scripts. Attacker must be a local, low-privileged user on the device. No victim interaction required. |
| Impact | High-severity local privilege escalation affecting Juniper Junos OS across multiple versions. Requires low-privilege authenticated access and non-standard configuration (unsigned Python op scripts enabled). CVSS 8.5 reflects complete confidentiality/integrity compromise. Limited by local-only attack vector and configuration prerequisite, reducing enterprise blast radius compared to network-exploitable flaws. Prioritize patching Internet-facing router deployments with op script functionality enabled. |
| Exploit ScenarioDerived | Authenticated local user submits malicious unsigned Python op script to device with permissive script configuration. Script executes with root privileges via UI handler, granting attacker system-level control. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Local privilege escalation in Juniper Networks Junos OS and Junos OS Evolved allows low-privileged authenticated users to execute arbitrary code with root privileges. When unsigned Python operation scripts are enabled in device configuration, attackers can inject and execute malicious op scripts under root-equivalent context, achieving complete system compromise. Affects all Junos OS versions before 22.4R3-S7 and multiple branches through 24.4, plus corresponding Junos OS Evolved releases. No public exploit identified at time of analysis. CVSS 8.5 (High) with local attack vector requiring low privileges and no user interaction.
RemediationAI
Vendor-released patches available across multiple release branches. For Junos OS, upgrade to 22.4R3-S7, 23.2R2-S4, 23.4R2-S6, 24.2R2, or 24.4R2 depending on current release train. For Junos OS Evolved, apply 22.4R3-S7-EVO, 23.2R2-S4-EVO, 23.4R2-S6-EVO, 24.2R2-EVO, or 24.4R2-EVO. Immediately disable unsigned Python op script execution in device configuration as interim mitigation if upgrade cannot be performed immediately. Review and restrict Python script permissions to trusted administrators only. Audit existing op scripts for unauthorized modifications. Comprehensive advisory and upgrade guidance available at https://kb.juniper.net/JSA103142. Organizations running affected versions should prioritize patching due to complete system compromise potential.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause is improper privilege management (CWE-250) in Python op script execution framework. When device configuration permits unsigned Python scripts, the execution context fails to enforce proper privilege separation, granting root-level permissions to scripts invoked by non-root users. This violates least-privilege principles in Junos OS scripting subsystem across both traditional and Evolved platforms.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/V:C/RE:M/U:Amber
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
An Execution with Unnecessary Privileges vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to gain root privileges, thus compromising the system.
When a configuration that allows unsigned Python op scripts is present on the device, a non-root user is able to execute malicious op scripts as a root-equivalent user, leading to privilege escalation.
This issue affects Junos OS:
- All versions before 22.4R3-S7,
- from 23.2 before 23.2R2-S4,
- from 23.4 before 23.4R2-S6,
- from 24.2 before 24.2R1-S2, 24.2R2,
- from 24.4 before 24.4R1-S2, 24.4R2;
Junos OS Evolved:
- All versions before 22.4R3-S7-EVO,
- from 23.2 before 23.2R2-S4-EVO,
- from 23.4 before 23.4R2-S6-EVO,
- from 24.2 before 24.2R2-EVO,
- from 24.4 before 24.4R1-S1-EVO, 24.4R2-EVO.
Executive ViewAI
Juniper Networks Junos OS and Junos OS Evolved contain a local privilege escalation vulnerability (CVE-2026-33793) that allows low-privileged authenticated users to execute arbitrary code with root privileges when unsigned Python operation scripts are enabled. This affects network infrastructure devices across multiple OS versions and could enable complete system compromise by internal or local attackers, creating significant risk for organizations relying on Juniper routing and switching equipment.
Apply vendor patch. If immediate patching is not feasible: (1) Disable unsigned Python operation scripts in device configuration to eliminate the attack vector; (2) Restrict local and authenticated access to affected devices through network segmentation and access control lists; (3) Monitor for suspicious op script execution and privilege escalation attempts in device logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB