---
id: CVE-2026-33774
title: >-
  An Improper Check for Unusual or Exceptional Conditions vulnerability in the
  packet forwarding engine (pfe) of Juniper Networks Junos OS on MX Series
  allows an unauthenticated, network-based attacker to bypass the configured
  firewall fil…
summary: >-
  An Improper Check for Unusual or Exceptional Conditions vulnerability in the
  packet forwarding engine (pfe) of Juniper Networks Junos OS on MX Series
  allows an unauthenticated, network-based attacker to bypass the configured
  firewall fil…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-754
vendor: juniper
product: junos
affected:
  - junos < 23.2
  - junos = 23.2
  - junos = 23.4
  - junos = 24.2
  - junos = 24.4
patched:
  - junos 23.2
published: '2026-04-09'
updated: '2026-07-08'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-33774'
references:
  - url: 'https://kb.juniper.net/JSA107865'
    label: sirt@juniper.net
tags:
  - nvd
epss: 0.0029
epssPercentile: 0.19126
ingestedAt: '2026-07-08T03:46:38.633Z'
---

## Overview

An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass the configured firewall filter and access the control-plane of the device.

On MX platforms with 

MPC10, MPC11, LC4800 or LC9600

line cards, and MX304, firewall filters applied on a loopback interface lo0.n (where n is a non-0 number) don't get executed when lo0.n is in the global VRF / default routing-instance.

 An affected configuration would be:

user@host# show configuration interfaces lo0 | display set
set interfaces lo0 unit 1 family inet filter input <filter-name>

where a firewall filter is applied to a non-0 loopback interface, but that loopback interface is not referred to in any routing-instance (RI) configuration, which implies that it's used in the default RI.

The issue can be observed with the CLI command:

user@device> show firewall counter filter <filter_name> 

not showing any matches.

This issue affects Junos OS on MX Series:

  *  all versions before 23.2R2-S6,
  *  23.4 versions before 23.4R2-S7,
  *  24.2 versions before 24.2R2,
  *  24.4 versions before 24.4R2.

## Affected

- `junos < 23.2`
- `junos = 23.2`
- `junos = 23.4`
- `junos = 24.2`
- `junos = 24.4`

## Remediation

Upgrade past the affected range:

- `junos 23.2`