EUVD-2026-21088
GHSA-9hcr-jp7m-44jv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPosition self on network path between SRX and SD cloud
-
DeliveryIntercept TLS connection attempt
-
ExploitPresent forged certificate to SRX
-
ExecutionSRX fails to validate certificate chain
-
ImpactAttacker decrypts and reads credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V12 - Secure Communication Certificate chain validation
|
| Exploitation Conditions | SRX Series device configured to connect to Juniper Security Director (SD) cloud. Remote unauthenticated attacker must perform man-in-the-middle attack on the SRX-to-SD cloud connection. Affects Junos OS versions before 2 on SRX Series. No victim interaction required. |
| Impact | High-severity vulnerability affecting unauthenticated network-based PITM attacks against SRX devices connecting to Security Director cloud. CVSS 8.3 reflects high confidentiality impact and limited integrity risk. Attack requires network positioning (AC:H), but affects credential and sensitive data exposure. Widespread impact across multiple Junos OS versions with patch availability, making prioritization critical for organizations running SRX cloud integrations. |
| Exploit ScenarioDerived | Attacker positioned on network path between SRX and SD cloud intercepts TLS handshake, presents forged certificate due to insufficient chain-of-trust validation. SRX accepts certificate and establishes encrypted channel with attacker, exposing authentication credentials and configuration data for credential theft or lateral movement. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Certificate chain validation bypass in Juniper Junos OS J-Web on SRX Series enables person-in-the-middle attackers to intercept Security Director cloud communications, exposing credentials and sensitive data. All SRX devices connecting to SD cloud fail to properly verify server certificates, allowing interception of authentication material and configuration data. Affects Junos OS versions across all branches prior to 22.4R3-S9, 23.2R2-S6, 23.4R2-S7, 24.2R2-S3, 24.4R2-S2, and 25.2R1-S2/25.2R2. No public exploit identified at time of analysis. Network-positioned attacker with high complexity required (CVSS AC:H).
RemediationAI
Vendor-released patches: upgrade to Junos OS 22.4R3-S9, 23.2R2-S6, 23.4R2-S7, 24.2R2-S3, 24.4R2-S2, 25.2R1-S2, or 25.2R2 depending on current branch. Prioritize devices actively provisioned for Security Director cloud connectivity. Interim mitigation: disable automatic SD cloud provisioning via J-Web if not operationally required, restrict management network access to trusted segments, deploy network-based TLS inspection to detect anomalous certificate chains on SRX management traffic. Monitor for unexpected certificate changes in SD cloud sessions. Official vendor advisory with detailed upgrade paths: https://kb.juniper.net/JSA107823
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-296: Improper Following of Certificate Chain of Trust. J-Web provisioning client omits critical X.509 certificate chain verification steps when establishing TLS sessions to Security Director cloud infrastructure. Missing hostname validation, certificate authority trust path verification, or certificate revocation checks enable TLS session hijacking. Network protocol implementation flaw specific to SRX SD cloud integration component, not general J-Web certificate handling.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/RE:M
Primary rating from Vendor (juniper) · only source for this CVE.
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
An Improper Following of a Certificate's Chain of Trust vulnerability in J-Web of Juniper Networks Junos OS on SRX Series allows a PITM to intercept the communication of the device and get access to confidential information and potentially modify it.
When an SRX device is provisioned to connect to Security Director (SD) cloud, it doesn't perform sufficient verification of the received server certificate. This allows a PITM to intercept the communication between the SRX and SD cloud and access credentials and other sensitive information.
This issue affects Junos OS:
- all versions before 22.4R3-S9,
- 23.2 versions before 23.2R2-S6,
- 23.4 versions before 23.4R2-S7,
- 24.2 versions before 24.2R2-S3,
- 24.4 versions before 24.4R2-S2,
- 25.2 versions before 25.2R1-S2, 25.2R2.
Executive ViewAI
CVE-2026-33779 is a certificate validation bypass in Juniper Junos OS J-Web that allows network-positioned attackers to intercept encrypted communications between SRX firewalls and Juniper Security Director cloud services, potentially exposing authentication credentials and sensitive configuration data. Organizations operating SRX Series devices connected to Security Director cloud services face credential compromise and data exposure risks until patching is completed.
Apply vendor patch. If immediate patching is not possible: restrict network access to Security Director cloud endpoints to dedicated security zones; implement network segmentation to limit lateral movement from compromised SRX devices; monitor Security Director communications for anomalous authentication patterns; consider temporary discontinuation of cloud-based Security Director integration until patching is feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB