{"id":"CVE-2026-33774","title":"An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass the configured firewall fil…","summary":"An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass the configured firewall fil…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cwe":["CWE-754"],"vendor":"juniper","product":"junos","affected":["junos < 23.2","junos = 23.2","junos = 23.4","junos = 24.2","junos = 24.4"],"patched":["junos 23.2"],"published":"2026-04-09","updated":"2026-07-08","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33774","references":[{"url":"https://kb.juniper.net/JSA107865","label":"sirt@juniper.net"}],"tags":["nvd"],"epss":0.00174,"epssPercentile":0.071,"ingestedAt":"2026-07-08T03:46:38.633Z","slug":"CVE-2026-33774","body":"## Overview\n\nAn Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass the configured firewall filter and access the control-plane of the device.\n\nOn MX platforms with \n\nMPC10, MPC11, LC4800 or LC9600\n\nline cards, and MX304, firewall filters applied on a loopback interface lo0.n (where n is a non-0 number) don't get executed when lo0.n is in the global VRF / default routing-instance.\n\n An affected configuration would be:\n\nuser@host# show configuration interfaces lo0 | display set\nset interfaces lo0 unit 1 family inet filter input <filter-name>\n\nwhere a firewall filter is applied to a non-0 loopback interface, but that loopback interface is not referred to in any routing-instance (RI) configuration, which implies that it's used in the default RI.\n\nThe issue can be observed with the CLI command:\n\nuser@device> show firewall counter filter <filter_name> \n\nnot showing any matches.\n\nThis issue affects Junos OS on MX Series:\n\n  *  all versions before 23.2R2-S6,\n  *  23.4 versions before 23.4R2-S7,\n  *  24.2 versions before 24.2R2,\n  *  24.4 versions before 24.4R2.\n\n## Affected\n\n- `junos < 23.2`\n- `junos = 23.2`\n- `junos = 23.4`\n- `junos = 24.2`\n- `junos = 24.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `junos 23.2`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}