Read the docs
TI-2026-26151 Aliases CVE-2026-33773GHSA-m7p5-cqg5-94p6

Junos OS: EX Series, QFX Series: If the same egress filter is configured on both an IRB…

Priority LOW 36CWE-1419Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

An Incorrect Initialization of Resource vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series and QFX Series device allows an unauthenticated, network-based attacker to cause an integrity impact to downstream networks. When the same family inet or inet6 filter is applied on an IRB interface and on a physical interface as egress filter on EX4100, EX4400, EX4650 and QFX5120 devices, only one of the two filters will be applied, which can lead to traffic being sent out one of these interfaces which should have been blocked. This issue affects Junos OS on EX Series and QFX Series: * 23.4 version 23.4R2-S6, * 24.2 version 24.2R2-S3. No other Junos OS versions are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00204 10th percentileScored 2026-11-07
Fix Fixed Junos OS (Juniper Networks): 23.4R2-S7, 24.2R2-S4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JuniperJunos OS23.4R2-S6 to before 23.4R2-S7; 24.2R2-S3 to before 24.2R2-S423.4R2-S7, 24.2R2-S4Patch availableCNA
  • Junos OS VendorJuniper Affected 23.4R2-S6 to before 23.4R2-S7; 24.2R2-S3 to before 24.2R2-S4 Fixed in 23.4R2-S7, 24.2R2-S4 Patch available CNA

CPE configurations NVD · 28

CPEVersionsRoleVendor
cpe:2.3:o:juniper:junos:23.4:r2-s6:*:*:*:*:*:*23.4 r2-s6VulnerableJuniper
cpe:2.3:o:juniper:junos:24.2:r2-s3:*:*:*:*:*:*24.2 r2-s3VulnerableJuniper
cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:ex4000:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:ex4100:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:ex4100-f:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:ex4100-h:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:ex4300:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
  • cpe:2.3:o:juniper:junos:23.4:r2-s6:*:*:*:*:*:* Versions 23.4 r2-s6 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:24.2:r2-s3:*:*:*:*:*:* Versions 24.2 r2-s3 Vulnerable ·Juniper
  • cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:ex4000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:ex4100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:ex4100-f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:ex4100-h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:ex4300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
Show 18 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:juniper:ex4400:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:ex9204:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:ex9208:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:ex9214:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx10008:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx10016:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5130:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5220:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5230-64cd:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5240:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5241:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5700:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
  • cpe:2.3:h:juniper:ex4400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:ex9204:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:ex9208:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:ex9214:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx10008:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx10016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5130:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5220:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5230-64cd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5240:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5241:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper

Remediation

  • Fix · CNA Junos OS (Juniper Networks) Fixed in 23.4R2-S7, 24.2R2-S4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33773
  2. 2026-10-03 Alias added: GHSA-m7p5-cqg5-94p6

References

Advisory 1

  • TI-2023-18638 Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01585 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
  • TI-2025-15550 Junos OS: An local attacker with shell access can execute arbitrary code KEVCVSS 4.0MEDIUM 6.7
  • TI-2023-18644 Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files KEVCVSS 3.1MEDIUM 5.3
  • TI-2023-18640 Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files KEVCVSS 3.1MEDIUM 5.3
See all 792 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences