Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-33796: Juniper Junos OS/Evolved can let remote attacker run admin commands
CVE-2026-33796 · published today
Summary
If BMP route monitoring is enabled, a malicious BGP neighbor can overflow a buffer in the routing daemon and execute any command with full system privileges. This could let an attacker take control of the router. Apply Juniper's security update or disable BMP monitoring until the patch is installed.
What to do
- Update juniper networks junos os to version 23.2R2-S7.7 or later.
- Update juniper networks junos os evolved to version 23.2R2-S7.7-EVO or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| juniper networks | junos os | < 23.2R2-S7.7 |
| juniper networks | junos os evolved | < 23.2R2-S7.7-EVO |
Original advisory text
Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP route monitoring is enabled
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring.
References
- https://supportportal.juniper.net/JSA112187 vendor-advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.3
Critical
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published14 Oct 2026
Updated14 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta