Which versions of Juniper are affected by EUVD-2026-21201?

CVE-2026-33783 is a HIGH-severity denial-of-service vulnerability in Juniper Junos OS Evolved on PTX routers that allows authenticated network users to permanently crash the forwarding plane by…. A patch is available.

How to fix or mitigate EUVD-2026-21201?

Within 24 hours: Identify all PTX Series routers running Junos OS Evolved through version 25.2 and confirm whether PCEP-provisioned colored SRTE policies with 32-bit ASN values (>65,535) are in production. Within 7 days: Apply vendor-released patch to affected PTX Series systems; if unavailable for your specific release train, implement the compensating control below. Within 30 days: Complete patching of all affected PTX Series routers and validate forwarding plane stability post-remediation.

Juniper EUVD-2026-21201

Q: What is the CVSS score of EUVD-2026-21201?

EUVD-2026-21201 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-33783 HIGH

Function Call With Incorrect Argument Type (CWE-686)

2026-04-09 sirt@juniper.net

GHSA-q83c-r2qf-fvp6

Denial Of Service Juniper

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 18:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:59 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

25.2R1-S2-EVO,24.4R2-S2-EVO,24.2R2-S4-EVO

EUVD ID Assigned

Apr 09, 2026 - 22:22 euvd

EUVD-2026-21201

Analysis Generated

Apr 09, 2026 - 22:22 vuln.today

CVE Published

Apr 09, 2026 - 22:16 nvd

HIGH 7.1

DescriptionCVE.org

A Function Call With Incorrect Argument Type vulnerability in the sensor interface of Juniper Networks Junos OS Evolved on PTX Series allows a network-based, authenticated attacker with low privileges to cause a complete Denial of Service (DoS).

If colored SRTE policy tunnels are provisioned via PCEP, and gRPC is used to monitor traffic in these tunnels, evo-aftmand crashes and doesn't restart which leads to a complete and persistent service impact. The system has to be manually restarted to recover. The issue is seen only when the Originator ASN field in PCEP contains a value larger than 65,535 (32-bit ASN). The issue is not reproducible when SRTE policy tunnels are statically configured.

This issue affects Junos OS Evolved on PTX Series:

all versions before 22.4R3-S9-EVO,
23.2 versions before 23.2R2-S6-EVO,
23.4 versions before 23.4R2-S7-EVO,
24.2 versions before 24.2R2-S4-EVO,
24.4 versions before 24.4R2-S2-EVO,
25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO.

AnalysisAI

Complete persistent denial of service in Juniper Networks Junos OS Evolved on PTX Series routers allows authenticated, low-privilege network attackers to crash the evo-aftmand service with no automatic recovery. The vulnerability triggers when PCEP-provisioned colored SRTE policy tunnels with 32-bit ASN values (greater than 65,535) in the Originator ASN field are monitored via gRPC, causing permanent forwarding plane failure until manual system restart. Affects multiple versions through 25.2 release train. No public exploit identified at time of analysis.

Technical ContextAI

Root cause is incorrect argument type handling (CWE-686) in sensor interface between gRPC monitoring subsystem and PCEP-based SRTE tunnel provisioning. Function call fails when processing 32-bit ASN values instead of expected 16-bit range, causing unhandled exception in evo-aftmand daemon. Static SRTE configuration bypasses vulnerable code path. CPE: cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:* on PTX hardware.

RemediationAI

Vendor-released patches: upgrade to Junos OS Evolved 22.4R3-S9-EVO, 23.2R2-S6-EVO, 23.4R2-S7-EVO, 24.2R2-S4-EVO, 24.4R2-S2-EVO, 25.2R1-S2-EVO, or 25.2R2-EVO depending on deployment branch. Workaround for systems unable to patch immediately: disable gRPC-based monitoring for colored SRTE policy tunnels, or migrate SRTE policies from PCEP-based provisioning to static configuration which bypasses vulnerable sensor interface. Restrict PCEP session establishment to trusted PCE controllers only. Full technical details and vendor advisory: https://kb.juniper.net/JSA107870. Note this vulnerability requires authenticated access with low privileges and specific PCEP/gRPC configuration overlap; EPSS data shows low observed exploitation activity.