Junos OS Evolved CVE-2026-33794

Exploitation requires the target to be a PTX Series router running Junos OS Evolved 24.4R2-EVO through pre-24.4R2-S3-EVO or 25.2 through pre-25.2R2-EVO, and the attacker must be able to generate continuous routing updates that cause the router to form unilist (unified-list) ECMP routes - the specific condition is the processing of unilist ECMP routing updates, most impactful in large-scale ECMP unilist deployments. Limiting factors are significant: the CVSS AT:P flag and the vendor statement confirm that successful exploitation depends on 'a sequence of events outside an attacker's direct control,' so the attacker cannot deterministically trigger the crash; it is realistically reachable only where the router accepts/processes attacker-influenced routing updates at ECMP scale. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the practical prerequisite of injecting sustained ECMP-generating routing updates against a large-scale deployment meaningfully narrows real-world exploitability.

The signals are internally consistent and point to a real but conditional availability risk. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, VA:H, SA:L) scores 8.2 (High): network-reachable and unauthenticated, but crucially carries AT:P (attack requirements present), which aligns with the vendor's statement that exploitation hinges on a 'sequence of events outside an attacker's direct control' - i.e., the attacker cannot reliably force the exact routing-update/unilist conditions on demand. Impact is availability-only (no confidentiality or integrity), with VA:H on the vulnerable system and SA:L subsequent impact. There is no EPSS score, no SSVC decision, no KEV listing, and no POC in the provided data, so exploitation probability cannot be quantified - but the combination of unauthenticated network vector against carrier-core routers makes this a legitimate patch priority for exposed PTX deployments, tempered by the non-deterministic trigger conditions. This is a genuine availability concern for large-scale ECMP environments, not a low-real-risk inflated score, but it is not a point-and-click DoS.

An attacker positioned to influence routing state toward an exposed PTX core router (for example via a peering session or upstream route injection) generates continuous routing updates that repeatedly create and churn equal-cost paths, driving the router to build large-scale unilist ECMP next-hop structures. Under the right sequence of updates, evo-aftmand mishandles the exceptional condition, corrupts internal state, and cores on the PFE, dropping forwarding on that FPC until an operator manually restarts it. No public exploit code is known, and the precise triggering sequence is not fully under the attacker's control.