CVE-2026-33801: Juniper Junos OS RPD Crash via Malformed BGP Update

Vulnerability Overview Vulnerability Name: 2026-07 Security Bulletin: Junos OS and Junos OS Evolved: When a specifically malformed BGP route update is received RPD crashes (CVE-2026-33801) Vulnerability ID: JSA110076 Date Created: 2026-07-08 Last Updated: 2026-07-08 Severity: Medium CVSS Score: - CVSS v3.1: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - CVSS v4.0: 7.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/V:R/CR:H/IR:H/SC:N/SI:A/LA:U/VR:M) Affected Products Affected Products: Junos OS 25.2 and Junos OS Evolved 25.2 Specific Impact: - Junos OS versions 25.2 before 25.2R2 - Junos OS Evolved versions 25.2 before 25.2R2-EVO Description: An "abnormal condition check" vulnerability exists in the Routing Protocol Daemon (RPD). When a specifically malformed BGP route update is received, it causes the RPD to crash and restart, leading to service interruption. Remediation Fixed Versions: - Junos OS: 25.2R2, 25.4R1, and later versions - Junos OS Evolved: 25.2R2-EVO, 25.4R1-EVO, and later versions Workaround: There are currently no known workarounds for this issue. Additional Information: - This issue is being tracked via KB 1907528, which is visible on the Customer Support website. - Juniper SIRT does not evaluate versions beyond End of Engineering (EOE) or End of Life (EOL). Related Resources KB16413: Overview of Juniper Networks SIRT Quarterly Security Bulletin Release Process KB16765: Which versions are affected by the vulnerability? KB16446: Common Vulnerability Scoring System (CVSS) and Juniper Security Bulletins Reporting Security Vulnerabilities: How to Contact the Juniper Networks Security Incident Response Team Additional Information Revision History: 2026-07-08: Initial Release Affected Product Series/Features: Relevant links are available at the bottom of the page, but specific content is not displayed. Code Block No POC code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-33801: Juniper Junos OS RPD Crash via Malformed BGP Update