IT SBIT Services
Schneeberger
DEEN
CVE tracker

Juniper Junos OS and Junos OS Evolved: Stack-based buffer overflow in srxpfe

CVE-2026-33798High 8.7

← All vulnerabilities

Summary

A stack-based buffer overflow in the srxpfe component of Junos OS and Junos OS Evolved on SRX Series devices allows an attacker on the same layer-2 network to execute arbitrary code as root. The attack uses high-availability fabric traffic. The issue only applies when a chassis cluster is configured, and no authentication is required. The vendor reports no known exploitation.

Affected

  • Junos OS: 0 to < 23.2R2-S7.7; 23.4 to < 23.4R2-S8.13; 24.2 to < 24.2R2-S5.5; 24.4 to < 24.4R2-S5; 25.2 to < 25.2R2-S2; 25.4 to < 25.4R1-S3; 26.2 to < 26.2R1-S2 (default: unaffected)
  • Junos OS Evolved: 0 to < 23.2R2-S7.7-EVO; 23.4 to < 23.4R2-S8.11-EVO; 24.2 to < 24.2R2-S5.6-EVO; 24.4 to < 24.4R2-S5-EVO; 25.2 to < 25.2R2-S2-EVO; 25.4 to < 25.4R1-S3-EVO; 26.2 to < 26.2R1-S2-EVO; 23.4X100; 25.2X100 to < 25.2X100-D35-EVO; 25.4X300 to < 25.4X300-D40-EVO (default: unaffected)
  • Required configuration: chassis-cluster with fabric interfaces (fab0/fab1)

Fixed in

  • Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all later releases
  • Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all later releases
  • Releases 23.2, 23.4 and 24.2 (and their EVO equivalents) were respun; use the respins listed in JSA112186
  • Fixed version for 23.4X100 is not stated in the record: check JSA112186

Workaround

  • Juniper reports no known workarounds.
  • Unknown whether mitigations exist for releases without a patch; check JSA112186.

Exploitation

  • Juniper SIRT is not aware of any malicious exploitation.
  • Not listed in the CISA KEV catalog according to OpenCVE (not a CISA statement).
  • CISA SSVC (Vulnrichment): exploitation none, automatable no, technical impact total.

Our recommendation

  • Check whether any SRX device runs in a chassis cluster; standalone units are not affected by this issue.
  • Patch affected clusters to the fixed versions in JSA112186 as soon as possible.
  • Restrict the chassis-cluster fabric links to dedicated, isolated segments until patched.
  • Patch the whole advisory, as JSA112186 also covers other SRX flaws.
  • Monitor the vendor advisory and CISA KEV for changes.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:58.

Original description (NVD)

A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed