Juniper Junos OS CVE-2026-33801

Exploitation requires an established BGP session between the attacker and the target RPD, and the attacker must be able to send a specifically malformed BGP UPDATE for a non-inet/inet6 unicast address family over that session - so the attacker must be a configured BGP neighbor (or occupy an on-path/adjacent position able to inject into the session). No authentication beyond the peering relationship is needed (PR:N) and no user interaction is required (UI:N). Limiting factors: the target must run an affected 25.2 build (Junos OS 25.2 before 25.2R2, or Junos OS Evolved 25.2 before 25.2R2-EVO) - devices on any train before 25.2R1 are not vulnerable; the vector is adjacent (AV:A), not fully remote-internet, because it depends on the BGP trust relationship; and impact is availability-only (no data compromise, no downstream readvertisement of the malformed update).

The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L) scores 7.1 (High) and is internally consistent with the description: an adjacent (AV:A) attacker needs no authentication (PR:N) or user interaction (UI:N) and low complexity (AC:L) to achieve high availability impact (VA:H) with a lesser subsequent-system availability effect (SA:L) from network-wide reconvergence; there is no confidentiality or integrity impact. The critical mitigating factor not captured in the raw score is that exploitation requires an already-established BGP session, meaning the attacker must be a configured/trusted BGP neighbor or occupy a position that lets them inject into that session - this is a meaningful trust barrier that makes indiscriminate mass exploitation unlikely. No EPSS score was provided; no POC is referenced; KEV status is not listed. On balance this is a real but bounded operational risk: high impact against a widely deployed vendor, but gated by the BGP peering trust relationship and limited to only the 25.2 release train, so it warrants prompt patching for exposed routers (especially those with external/eBGP peers) rather than emergency treatment.

An attacker who is a BGP peer of a vulnerable router - for example a malicious or compromised customer/transit neighbor, or an adjacent party able to inject into an established eBGP session - sends a single crafted non-inet/inet6 unicast BGP UPDATE over that session. RPD hits the unhandled condition and crashes, dropping all routing adjacencies on the device and causing a service outage until routing reconverges. No public exploit code is currently identified, and low attack complexity means the malformed packet is reliably reproducible once the peering position is held.