EUVD-2026-21207
GHSA-j4rr-c2v3-296r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as high-privileged local user
-
DeliveryExecute crafted 'set system' CLI command
-
ExploitInject arbitrary shell metacharacters
-
ExecutionExecute injected commands as root
-
ImpactAchieve system compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Local attacker with high-privilege (root or administrative) access to Juniper Junos OS CLI. Attacker must execute specific crafted 'set system' commands with malicious arguments. Affects Junos OS versions before 22.4R3. No remote exploitation possible; requires direct system access. |
| Impact | CVSS 8.4 reflects high impact (root code execution, system compromise) but requires high-privilege local access, significantly limiting real-world blast radius. Enterprise networks with strict administrative access controls face reduced risk; smaller operations or those with permissive sudo policies require immediate patching. EPSS data absent; KEV status unknown. Extensive affected version ranges across multiple releases demand systematic inventory and staged remediation. |
| Exploit ScenarioDerived | Authenticated high-privilege user executes crafted 'set system' CLI command with injected shell metacharacters. Unsanitized argument parsing allows arbitrary command execution as root. No public exploit code identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Command injection in Juniper Networks Junos OS and Junos OS Evolved CLI processing allows high-privileged local attackers to execute arbitrary shell commands as root through crafted 'set system' arguments, enabling complete system compromise. Affects all versions before multiple fixed releases across both operating systems. Authentication required (high-privileged local access). No public exploit identified at time of analysis.
RemediationAI
Vendor-released patches: Upgrade Junos OS to 22.4R3-S8, 23.2R2-S5, 23.4R2-S7, 24.2R2-S2, 24.4R2, or 25.2R2 depending on deployment branch. For Junos OS Evolved, upgrade to 22.4R3-S8-EVO, 23.2R2-S5-EVO, 23.4R2-S7-EVO, 24.2R2-S2-EVO, 24.4R2-EVO, 25.2R1-S1-EVO, or 25.2R2-EVO. Workaround: Restrict CLI access to trusted administrators only, implement role-based access controls limiting 'set system' command execution, and audit command usage through logging. Review privilege separation policies to minimize accounts with configuration rights. Full technical details and upgrade guidance: https://kb.juniper.net/JSA107875
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause: inadequate input sanitization in CLI command parser for 'set system' family commands (CWE-78). Crafted arguments bypass validation, injecting shell metacharacters that execute as root-level processes. Affects both Junos OS and Junos OS Evolved CLI frameworks, indicating shared command processing architecture vulnerability.
Know when Juniper gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M/U:Amber
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
An OS Command Injection vulnerability in the CLI processing of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker executing specific, crafted CLI commands to inject arbitrary shell commands as root, leading to a complete compromise of the system.
Certain 'set system' commands, when executed with crafted arguments, are not properly sanitized, allowing for arbitrary shell injection. These shell commands are executed as root, potentially allowing for complete control of the vulnerable system. This issue affects:
Junos OS:
- all versions before 22.4R3-S8,
- from 23.2 before 23.2R2-S5,
- from 23.4 before 23.4R2-S7,
- from 24.2 before 24.2R2-S2,
- from 24.4 before 24.4R2,
- from 25.2 before 25.2R2;
Junos OS Evolved:
- all versions before 22.4R3-S8-EVO,
- from 23.2 before 23.2R2-S5-EVO,
- from 23.4 before 23.4R2-S7-EVO,
- from 24.2 before 24.2R2-S2-EVO,
- from 24.4 before 24.4R2-EVO,
- from 25.2 before 25.2R1-S1-EVO, 25.2R2-EVO.
Executive ViewAI
CVE-2026-33791 is a high-severity command injection vulnerability in Juniper Networks Junos OS and Junos OS Evolved that allows authenticated high-privileged local users to execute arbitrary commands as root, potentially enabling complete system compromise of affected network infrastructure. Organizations operating Juniper devices must prioritize patching to prevent insider threats and post-compromise persistence by administrators with elevated access. This vulnerability directly impacts the integrity and availability of critical routing and switching infrastructure.
Apply vendor patch. Interim mitigation: Restrict high-privileged CLI access to trusted administrative accounts only; implement detailed command audit logging for all 'set system' operations; monitor for suspicious shell command execution patterns in system logs; enforce separation of duties to minimize accounts with root-level access to Juniper devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fe
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (
A security vulnerability in An Improper (CVSS 6.7) that allows a local attacker with high privileges. Risk factors: acti
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series all
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. Rated
jsdm/ajax/port.php in J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1 before 12.1R5, 12.2 before 12.2R3,
An authentication bypass vulnerability in Juniper Networks Junos Space Network Management Platform may allow a remote un
An issue was discovered in libslax through v0.22.1. Rated high severity (CVSS 8.8), this vulnerability is remotely explo
An issue was discovered in libslax through v0.22.1. Rated high severity (CVSS 8.8), this vulnerability is remotely explo
An issue was discovered in libslax through v0.22.1. Rated high severity (CVSS 8.8), this vulnerability is remotely explo
Certain Secure Access SA Series SSL VPN products (originally developed by Juniper Networks but now sold and supported by
Exploit-DB