Juniper Junos OS Privilege Escalation Vulnerability (CVE-2026-33793) Security Bulletin

2026-04 Security Bulletin: Junos OS and Junos OS Evolved Vulnerability Summary Vulnerability Overview CVE ID: CVE-2026-33793 Vulnerability Type: Privilege Escalation Severity: High CVSS Score: - v3.1: 8.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - v2.0: 8.5 (AV:L/AC:L/Au:N/C:C/I:C/A:C) Description: A "unnecessary privilege execution" vulnerability exists in the user interface (UI) of Juniper Networks Junos OS and Junos OS Evolved, allowing local low-privileged attackers to gain root privileges, thereby compromising the system. When the device is configured to allow unsigned Python op scripts, non-root users can execute malicious op scripts with root-equivalent privileges, leading to privilege escalation. Impact Scope Affected Junos OS Versions: All versions prior to 22.4R3-57 From 23.2 up to, but not including, 23.2R2-54 From 23.4 up to, but not including, 23.4R2-56 From 24.2 up to, but not including, 24.2R1-S2 and 24.2R2 From 24.4 up to, but not including, 24.4R1-S2 and 24.4R2 Affected Junos OS Evolved Versions: All versions prior to 22.4R3-57-EVO From 23.2 up to, but not including, 23.2R2-54-EVO From 23.4 up to, but not including, 23.4R2-56-EVO From 24.2 up to, but not including, 24.2R2-EVO From 24.4 up to, but not including, 24.4R1-S1-EVO and 24.4R2-EVO Trigger Conditions: Python 3 op scripts are enabled on the system: Risk of exploitation significantly increases when remote execution of Python 3 op scripts is allowed: Starting from Junos OS Evolved Release 21.2R1, the configuration group enables by default. Remediation Fixed Software Versions: Junos OS Evolved: 22.4R3-57-EVO, 23.2R2-54-EVO, 23.4R2-56-EVO, 24.2R2-EVO, 24.4R1-S1-EVO, 24.4R2-EVO, 25.2R1-EVO and all subsequent releases Junos OS: 22.4R3-57, 23.2R2-54, 23.4R2-56, 24.2R1-S2, 24.2R2, 24.4R1-S2, 24.4R2, 25.2R1 and all subsequent releases Temporary Mitigation Measures: Use access control lists or firewall filters to restrict CLI access to trusted hosts and administrators only. Additional Information: This issue is being tracked under case number 1842427 and can be viewed on the Customer Support website Juniper SIRT has not observed any malicious exploitation of this vulnerability This issue was discovered during internal product security testing or research

Goal Reached Thanks to every supporter — we hit 100%!

Juniper Junos OS Privilege Escalation Vulnerability (CVE-2026-33793) Security Bulletin