Junos OS CVE-2026-33796

Exploitation requires the target Junos OS / Junos OS Evolved device to have an established external BGP (eBGP) session with the attacker-controlled peer AND to have BMP (BGP Monitoring Protocol) route monitoring configured. The attacker must be, or must compromise, a configured external BGP neighbor - the router must already be set up to peer with the attacker, which is the primary limiting factor and means it is not exploitable by arbitrary internet hosts. Routers not running BMP route monitoring, or with no external BGP neighbors, are not exposed. No additional authentication or user interaction is needed once the peering relationship exists.

This is a genuine high-priority vulnerability, not a high-CVSS/low-real-risk case, but its exploitability is gated by a meaningful precondition. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) rates it network-reachable with no privileges and no user interaction, and the VC:H/VI:H/VA:H impact plus the CWE-121 stack overflow yielding arbitrary command execution as root justify the 9.3 score. However, the description states the attacker must be 'a configured external BGP neighbor' - the target must already be configured to peer with the attacker - so this is not internet-wide unauthenticated exploitation but exploitation from within an established eBGP trust relationship, and only when BMP route monitoring is in use. No EPSS score, KEV listing, or public exploit was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the realistic threat is a compromised or malicious BGP peer rather than opportunistic mass scanning. The PR:N rating reflects CVSS semantics (no account on the device) but should be read alongside the peering prerequisite, which materially narrows the attack surface.

An attacker who controls or compromises a device that is a configured external BGP neighbor of a vulnerable Junos router sends crafted BMP (BGP Monitoring Protocol) route-monitoring data. The malformed data overflows a stack buffer in the routing protocol daemon (rpd), allowing arbitrary commands to execute with root privileges on the router. No public exploit code has been identified at time of analysis.