Will Active BGP Monitoring on Junos OS Let Attackers Run Root Commands via CVE-2026-33789?

A stack-based buffer overflow in the routing protocol daemon of Juniper Networks devices allows unauthenticated attackers to execute commands with root privileges. According to the National Vulnerability Database, this critical flaw, identified as CVE-2026-33789, exists in both Junos OS and Junos OS Evolved. The vulnerability arises when the BGP Monitoring Protocol is active, enabling remote exploitation through crafted network traffic rather than requiring prior login credentials.

How does the vulnerability work?

The issue stems from a CWE-121 weakness within the routing protocol daemon, known as rpd. An attacker does not need to authenticate with the router to trigger the bug. Instead, they can send specifically crafted BGP route updates to the device. If the BGP Monitoring Protocol is enabled, the daemon processes these updates in a way that causes a stack-based buffer overflow. This memory error can lead to a denial of service or allow the attacker to run arbitrary commands with root-level access.

Which versions are affected?

Multiple versions of Juniper Networks Junos OS and Junos OS Evolved are vulnerable to CVE-2026-33789. Affected Junos OS releases include versions before 23.2R2-S7.7, before 23.4R2-S8.13, before 24.2R2-S5.5, and before 24.4R2-S5. For Junos OS Evolved, the vulnerable versions are those before 23.2R2-S7.7-EVO, before 23.4R2-S8.11-EVO, before 24.2R2-S5.6-EVO, and before 24.4R2-S5-EVO. Devices running earlier releases than these specified service levels remain exposed to the risk.

What is the severity rating?

The National Vulnerability Database lists CVE-2026-33789 as a critical severity vulnerability. One record assigns it a CVSS score of 9.8, while another record rates it at 9.2. Both scores fall within the critical range. The source material describes the vulnerability as allowing an unauthenticated BGP peer to cause a denial of service and potential root-level command execution. No further details on impact metrics are provided in the source records.

What should users do next?

No confirmed fix or patch has been announced in the provided source material. Users should verify which version of Junos OS or Junos OS Evolved their routers are currently running. If the version is older than the thresholds listed above, the device is potentially vulnerable. Organizations should monitor official channels from Juniper Networks for the release of updated software versions that address this stack-based buffer overflow. Until an update is available, limiting exposure to untrusted BGP peers may reduce risk.

What analysts watch for

Teams usually examine network logs for unusual BGP update patterns that precede system crashes or unexpected reboots. Analysts check whether the BGP Monitoring Protocol is enabled on edge routers, as this feature is required for the exploit to succeed. They look for signs of unauthorized command execution, such as new user accounts or modified configuration files, which indicate root-level access. Monitoring for traffic from known malicious IP addresses or anomalous route announcements helps detect early stages of an attack.

Background: CVSS score

The CVSS score provides a standardized number to rank vulnerability severity. Small teams should use it to prioritize patches, but must adjust for business context. A high score does not always mean immediate danger if the affected component is isolated or unused.

Read the full guide: CVSS Scores Explained: What Small Teams Must Know

What to do and how to stay safe: Juniper Networks

• Audit your network devices to determine if the BGP Monitoring Protocol is currently enabled.
• Check your current Junos OS or Junos OS Evolved version against the affected list provided by the NVD.
• Restrict BGP peering to trusted partners only, if possible, to limit exposure to unauthenticated traffic.
• Monitor system logs for signs of denial of service or unexpected process termination in the routing daemon.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-33789?

It is a critical stack-based buffer overflow vulnerability in the routing protocol daemon of Juniper Networks Junos OS and Junos OS Evolved.

Does the attacker need to log in to exploit this?

No, the vulnerability allows an unauthenticated BGP peer to trigger the flaw via crafted route updates.

Which Junos OS versions are safe?

Versions 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, and 24.4R2-S5 and later are not affected.