Junos OS EX Series CVE-2026-33802

The attacker must have local, authenticated CLI access to an affected EX Series switch (EX2300, EX4000, EX4100, EX4300-MP, or EX4400) running a vulnerable Junos OS version in the 23.2R2 through 25.4 release trains. No specific Junos login class, permission, or privilege elevation is required - any authenticated local user account is sufficient to trigger the vulnerability. The switch must be reachable via CLI (console, SSH, or Telnet if enabled). Exploitation is bounded by the AV:L constraint: an attacker without an existing authenticated local account or without network/console access to the CLI cannot exploit this remotely or without credentials. The specific 'request' command that triggers the condition is not publicly disclosed by Juniper. Defenders should note that the lack of any permission requirement means standard role-based CLI access controls in Junos (login classes) do not mitigate this unless command-level authorization via TACACS+ is enforced.

The CVSS 3.1 score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects the attack profile: local access is required (AV:L), complexity is low (AC:L), and only low-privilege authentication is needed (PR:L). Impact is confined to availability (A:H) with no confidentiality or integrity consequences. No KEV listing and no public exploit code are identified at time of analysis, and no EPSS data was provided in source intelligence. The real-world risk is moderate but contextually significant: while the CVSS score is not alarming, the fact that any authenticated Junos account - with no special class assignment - can trigger a complete traffic disruption represents a meaningful threat in environments with multiple CLI users, shared switch access, or insider threat scenarios. The automatic recovery limits the sustained business impact, but repeated triggering by a malicious insider could constitute an effective, difficult-to-block disruption campaign. Defenders should weight this above its raw score in high-availability environments where even brief traffic loss is unacceptable.

An attacker with any valid local Junos OS account on an affected EX Series switch - including a low-privilege monitoring or read-only account - logs into the CLI and executes a specific privileged 'request' command. Because the authorization check is absent, the command executes without restriction, immediately causing complete traffic disruption across the switch until the system automatically recovers. No exploit code is publicly known, but the technique requires only knowledge of the specific command and any authenticated CLI credential.