Junos OS Evolved: Lokaal, geauthenticeerde aanvaller kan geprivilegieerde toegang tot FPCs verkrijgen

The impact of CVE-2026-33788 is significant due to the potential for complete compromise of the affected FPC. An attacker who can exploit this vulnerability can bypass authentication controls and directly access the FPC, effectively gaining root-level access. This could allow them to modify system configurations, steal sensitive data stored on the FPC, or even pivot to other parts of the network. The ability to directly access the FPC represents a substantial escalation of privileges, making it a high-risk vulnerability. Successful exploitation could lead to denial of service, data breaches, and potentially complete network takeover.

Organizations utilizing Juniper Networks PTX10004, PTX10008, and PTX100016 devices running Junos OS Evolved versions prior to 21.2R3-S8-EVO are at significant risk. This includes data centers, network service providers, and any organization relying on these devices for critical network infrastructure. Environments with limited physical security controls or lax access management practices are particularly vulnerable.

• linux / server:

journalctl -u junos -g "FPC access"

• linux / server:

ps aux | grep -i fpc

• linux / server:

ssh -l low_priv_user <junos_device_ip> && sudo -u high_priv_user /path/to/fpc_access_tool

1. 2026-04-09Disclosure

   disclosure

1. Gereserveerd2026-03-23
2. Gepubliceerd2026-04-09
3. Gewijzigd2026-04-13
4. EPSS bijgewerkt2026-04-17

The primary mitigation for CVE-2026-33788 is to upgrade Juniper Junos OS Evolved to version 23.2R2-EVO or later. Prior to upgrading, it's crucial to review the release notes for any potential compatibility issues or breaking changes. If an immediate upgrade is not feasible, consider implementing network segmentation to limit the potential blast radius of a successful attack. While a direct workaround isn't available, restricting access to the FPCs and implementing strict authentication policies can reduce the attack surface. After upgrading, confirm the fix by attempting to access the FPC with a low-privilege user account and verifying that access is denied.