Which versions of Juniper Junos OS are affected by CVE-2026-33801?

Juniper Junos OS 25.2 contains a denial-of-service vulnerability enabling adjacent network peers to remotely crash the routing protocol daemon, causing complete routing outages until system recovery.. A patch is available.

How to fix or mitigate CVE-2026-33801?

24 hours: Identify all systems running Juniper Junos 25.2; restrict BGP peering to authentication-protected, pre-approved peers; review current BGP session security configurations. 7 days: Deploy BGP authentication (TCP-MD5) where supported; implement continuous BGP session monitoring and alerting for anomalies; contact Juniper support regarding patch availability. 30 days: Upon vendor patch release and testing, apply updates to affected systems; alternatively, execute controlled downgrade to Junos 25.1 or earlier if operationally feasible.

Juniper Junos OS CVE-2026-33801

Q: What is the CVSS score of CVE-2026-33801?

CVE-2026-33801 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42702 HIGH

Improper Check for Unusual or Exceptional Conditions (CWE-754)

2026-07-09 sirt@juniper.net

GHSA-cv9f-44gv-7rg6

Juniper Denial Of Service Junos Junos Os Evolved

7.1

CVSS 4.0 · Vendor: juniper

Severity by source

Vendor (juniper) PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X

vuln.today AI

6.5 MEDIUM

Adjacent BGP-peer position and unauthenticated malformed UPDATE give AV:A/PR:N/AC:L; impact is availability-only (A:H) with no confidentiality or integrity effect and no scope change.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Primary rating from Vendor (juniper).

CVSS VectorVendor: juniper

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 09, 2026 - 22:01 EUVD

Analysis Generated

Jul 09, 2026 - 21:36 vuln.today

DescriptionCVE.org

An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker sending a specific BGP update over an established BGP session to cause a Denial-of-Service (DoS).

Upon receipt of a specifically malformed non-inet/inet6 unicast BGP update, an RPD crash and restart is triggered, which will cause a complete service outage until routing has reconverged. The rpd crash occurs before the update can be readvertised, so there is no downstream propagation.

This issue affects:

Junos OS versions 25.2 before 25.2R2;
Junos OS Evolved versions 25.2 before 25.2R2-EVO.

This issue doesn't affect Junos OS versions before 25.2R1 nor Junos OS Evolved versions before 25.2R1-EVO.

Articles & Coverage 2

News 11 New Juniper Vulnerabilities - 11 High Severity, No Public Exploits Jul 10, 2026 News 8 New Juniper Vulnerabilities - 8 High Severity, No Public POC Jul 09, 2026

AnalysisAI

Remote denial-of-service in Juniper Networks Junos OS and Junos OS Evolved 25.2 (before 25.2R2 / 25.2R2-EVO) lets an adjacent, unauthenticated BGP peer crash the routing protocol daemon (RPD) by sending a single malformed non-inet/inet6 unicast BGP update over an already-established session. The RPD crash-and-restart produces a full routing outage until reconvergence completes, though the crash occurs before the update is readvertised so there is no downstream propagation to other routers. CVSS 4.0 base score is 7.1; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is RPD, the routing protocol daemon that implements BGP and other routing protocols on both Junos OS (FreeBSD-based) and Junos OS Evolved (Linux-based) control planes. The root cause is CWE-754 (Improper Check for Unusual or Exceptional Conditions): RPD fails to properly validate a specifically malformed BGP UPDATE message carrying a non-inet/inet6 unicast address family, and the unhandled exceptional condition causes the daemon to abort rather than gracefully discard the packet. Because RPD owns the entire routing state, its termination brings down all routing adjacencies on the device until the daemon restarts and re-establishes sessions. Only the 25.2 code train introduced the defect (25.2R1/25.2R1-EVO); earlier trains are unaffected, indicating a regression in BGP UPDATE parsing added in that release. No CPE strings were supplied in the input, so exact platform/hardware applicability is drawn from the vendor advisory text rather than NVD CPE data.

RemediationAI

Vendor-released patch: upgrade Junos OS to 25.2R2 or later, and Junos OS Evolved to 25.2R2-EVO or later, per Juniper advisory JSA110076 (https://supportportal.juniper.net/JSA110076). Where immediate upgrade is not possible, reduce exposure by restricting who can peer with the device: apply BGP session authentication and TTL security (GTSM) so only intended neighbors can establish sessions, tighten BGP import policy and prefix/address-family limits, and use firewall-filter/loopback lo0 protection to permit BGP (TCP/179) only from known peer addresses. These controls narrow the set of parties able to reach an established session but do not eliminate risk from a malicious or compromised legitimate peer, since the malformed UPDATE travels over a valid session; graceful-restart/nonstop-routing features can shorten outage duration but do not prevent the RPD crash itself. Patching remains the only complete fix.