Skip to content
OpenAdvisories
High WID-SEC-2026-1022 28 CVEs

Juniper Patchday April 2026: Mehrere Schwachstellen

Published Apr 8, 2026 · Updated Apr 9, 2026 · Revision 2 · de-DE

Vendor: Juniper Networks Product: Apstra Product: Junos Product: Junos Space Product: MX Series Product: QFX Series Product: SRX Series

Summary

Ein Angreifer kann mehrere Schwachstellen in Juniper Apstra, Junos OS, Junos OS Evolved und Junos Space ausnutzen, um erweiterte Berechtigungen – sogar Root-Rechte – zu erlangen, beliebigen Code auszuführen – auch mit erweiterten Berechtigungen –, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen oder Daten zu manipulieren.

Product

Juniper Apstra (ehemals bekannt als AOS) automatisiert alle Aspekte der Rechnzentrums-Netzwerkplanung, des Aufbaus, der Bereitstellung und des Betriebs.
JUNOS ist das "Juniper Network Operating System", das in Juniper Appliances verwendet wird.
Die Switches der QFX-Serie von Juniper sichern und automatisieren Netzwerke in Rechenzentren.
Die Juniper MX-Serie ist eine Produktfamilie von Routern.
SRX Series Services Gateways ist ein Next-Generation Anti-Threat Firewall von Juniper.
Junos Space ist eine Software-Plattform, die eine Reihe von Applikationen für das Netzwerkmanagement beinhaltet.

Vulnerabilities 28

  • Critical 9.8
    CVE-2026-33784

    JSI Virtual Lightweight Collector: Default password is not required to be changed which allows unauthorized high-privileged access

    A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device. vLWC software images ship with an initial passwor…

    Juniper Networks JSI LWC Network devices
  • High 8.8
    CVE-2026-33785

    Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands in a JDM/CSDS scenario

    A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on MX Series allows a local, authenticated user with low privileges to execute specific commands which will lead to a complete compromise of managed devices. Any user logged in, wit…

    Juniper Networks Junos OS Network devices
  • High 8.7
    CVE-2025-13914

    Apstra: SSH host key validation vulnerability for managed devices

    A Key Exchange without Entity Authentication vulnerability in the SSH implementation of Juniper Networks Apstra allows a unauthenticated, MITM attacker to impersonate managed devices. Due to insufficient SSH host key validation an attacker can perform a machi…

    Juniper Networks Apstra Network devices
  • High 7.8
    CVE-2026-33788

    Junos OS Evolved: Local, authenticated attacker can gain privileged access to FPCs

    A Missing Authentication for Critical Function vulnerability in the Flexible PIC Concentrators (FPCs) of Juniper Networks Junos OS Evolved on PTX Series allows a local, authenticated attacker with low privileges to gain direct access to FPCs installed in the …

    Juniper Networks Junos OS Evolved Network devices
  • High 7.8
    CVE-2026-33793

    Junos OS and Junos OS Evolved: When an unsigned Python op script configuration is present, a local low privileged user can compromise the system

    An Execution with Unnecessary Privileges vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to gain root privileges, thus compromising the system. When a configuration that allows…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • High 7.5
    CVE-2026-33778

    Junos OS: SRX Series, MX Series: When a specifically malformed first ISAKMP packet is received kmd/iked crashes

    An Improper Validation of Syntactic Correctness of Input vulnerability in the IPsec library used by kmd and iked of Juniper Networks Junos OS on SRX Series and MX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (…

    Juniper Networks Junos OS Network devices
  • High 7.5
    CVE-2026-33790

    Junos OS: SRX Series: In a NAT64 configuration, receipt of a specific, malformed ICMPv6 packet will cause the srxpfe process to crash and restart.

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the flow daemon (flowd) of Juniper Networks Junos OS on SRX Series allows an attacker sending a specific, malformed ICMPv6 packet to cause the srxpfe process to crash and restart. Contin…

    Juniper Networks Junos OS Network devices
  • High 7.4
    CVE-2026-33771

    CTP OS: Configuring password requirements does not work which permits the use of weak passwords

    A Weak Password Requirements vulnerability in the password management function of Juniper Networks CTP OS might allow an unauthenticated, network-based attacker to exploit weak passwords of local accounts and potentially take full control of the device. The p…

    Juniper Networks CTP OS Network devices
  • High 7.4
    CVE-2026-33797

    Junos OS and Junos OS Evolved: An attacker sending a specific genuine BGP packet causes a BGP reset

    An Improper Input Validation vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker, sending a specific genuine BGP packet in an already established BGP session to reset only that session causing a Denial …

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • High 7.3
    CVE-2026-21916

    Junos OS: A low privileged user can escalate their privileges so that they can login as root

    A UNIX Symbolic Link (Symlink) Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root which will lead to a complete compromise of the system. When after a…

    Juniper Networks Junos OS Network devices
  • Medium 6.7
    CVE-2025-30650

    Junos OS: Privileged local user can gain access to a Linux-based FPC as root

    A Missing Authentication for Critical Function vulnerability in command processing of Juniper Networks Junos OS allows a privileged local attacker to gain access to Linux-based line cards as root. This issue affects systems running Junos OS using Linux-based …

    Juniper Networks Junos OS Network devices
  • Medium 6.7
    CVE-2026-21915

    JSI Virtual Lightweight Collector: Shell escape allows privilege escalation to root

    A Permissive List of Allowed Input vulnerability in the CLI of Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows a local, high privileged attacker to escalate their privileges to root. The CLI menu accepts input without caref…

    Juniper Networks JSI LWC Network devices
  • Medium 6.7
    CVE-2026-33791

    Junos OS and Junos OS Evolved: Execution of crafted CLI commands allows for arbitrary shell injection as root

    An OS Command Injection vulnerability in the CLI processing of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker executing specific, crafted CLI commands to inject arbitrary shell commands as root, leading to a complete c…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 6.5
    CVE-2022-24805

    net-snmp: A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.

    net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a buffer overflow in the handling of the `INDEX` of `NET-SNMP-VACM-MIB` can cause an out-of-bounds memory access. A user with read-only credentials can…

    net-snmp Net-SNMP net-snmp net-snmp Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2025-59969

    Junos OS Evolved: QFX5000 Series and PTX Series: An attacker sending crafted multicast packets will cause evo-aftmand / evo-pfemand to crash and restart

    A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the advanced forwarding toolkit (evo-aftmand/evo-pfemand) of Juniper Networks Junos OS Evolved on PTX Series or QFX5000 Series allows an unauthenticated, adjacent attack…

    Juniper Networks Junos OS Evolved Network devices
  • Medium 6.5
    CVE-2026-21919

    Junos OS and Junos OS Evolved: A high frequency of connecting and disconnecting NETCONF sessions causes management unavailability

    An Incorrect Synchronization vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker with low privileges to cause a complete Denial-of-Service (DoS) of the management plane. When NETCONF s…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 6.5
    CVE-2026-33774

    Junos OS: MX Series: Firewall filters on lo0.<non-0> in the default routing instance are not in effect

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass the configured firewall filter and access the con…

    Juniper Networks Junos OS Network devices
  • Medium 6.5
    CVE-2026-33775

    Junos OS: MX Series: Mismatch between configured and received packet types causes memory leak in bbe-smgd

    A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS). If the …

    Juniper Networks Junos OS Network devices
  • Medium 6.5
    CVE-2026-33779

    Junos OS: SRX Series: Insufficient certificate verification for device to SD cloud communication

    An Improper Following of a Certificate's Chain of Trust vulnerability in J-Web of Juniper Networks Junos OS on SRX Series allows a PITM to intercept the communication of the device and get access to confidential information and potentially modify it. When an …

    Juniper Networks Junos OS Network devices
  • Medium 6.5
    CVE-2026-33780

    Junos OS and Junos OS Evolved: In an EVPN-MPLS scenario churn of ESI routes causes a memory leak in l2ald

    A Missing Release of Memory after Effective Lifetime vulnerability in the Layer 2 Address Learning Daemon (l2ald) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a memory leak ultimately leading to a Den…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 6.5
    CVE-2026-33781

    Junos OS: EX Series, QFX Series: In a VXLAN scenario when specific control protocol packets are received, memory leaks and eventually no traffic is passed

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX and QFX Series devices allow an unauthenticated, adjacent attacker to cause a complete Denial of Service (D…

    Juniper Networks Junos OS Network devices
  • Medium 6.5
    CVE-2026-33782

    Junos OS: MX Series: In specific DHCPv6 scenarios jdhcpd memory increases continuously with subscriber logouts

    A Missing Release of Memory after Effective Lifetime vulnerability in the DHCP daemon (jdhcpd) of Juniper Networks Junos OS on MX Series, allows an adjacent, unauthenticated attacker to cause a memory leak, that will eventually cause a complete Denial-of-Serv…

    Juniper Networks Junos OS Network devices
  • Medium 6.5
    CVE-2026-33783

    Junos OS Evolved: PTX Series: If SRTE tunnels provisioned via PCEP are present and specific gRPC queries are received evo-aftmand crashes

    A Function Call With Incorrect Argument Type vulnerability in the sensor interface of Juniper Networks Junos OS Evolved on PTX Series allows a network-based, authenticated attacker with low privileges to cause a complete Denial of Service (DoS). If colored SR…

    Juniper Networks Junos OS Evolved Network devices
  • Medium 6.1
    CVE-2026-21904

    Junos Space: ilpFilter field on nLegacy.jsp is vulnerable to reflected cross-site script injection

    An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the list filter field that, when visited by another user, enables the attacker to…

    Juniper Networks Junos Space Network devices
  • Medium 5.8
    CVE-2026-33773

    Junos OS: EX Series, QFX Series: If the same egress filter is configured on both an IRB and a physical interface one of those is not applied

    An Incorrect Initialization of Resource vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series and QFX Series device allows an unauthenticated, network-based attacker to cause an integrity impact to downstream n…

    Juniper Networks Junos OS Network devices
  • Medium 5.5
    CVE-2026-33776

    Junos OS and Junos OS Evolved: Specific low privileged CLI command exposes sensitive information

    A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a local user with low privileges to read sensitive information. A local user with low privileges can execute the CLI command 'show mgd' with specific arg…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 5.5
    CVE-2026-33786

    Junos OS: SRX1600, SRX2300, SRX4300: When a specific show command is executed chassisd crashes

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the chassis control daemon (chassisd) of Juniper Networks Junos OS on SRX1600, SRX2300 and SRX4300 allows a local attacker with low privileges to cause a complete Denial of Service (DoS)…

    Juniper Networks Junos OS Network devices
  • Medium 5.5
    CVE-2026-33787

    Junos OS: SRX1500, SRX4100, SRX4200, SRX4600: When a specific show command is executed chassisd crashes

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the chassis control daemon (chassisd) of Juniper Networks Junos OS on SRX1500, SRX4100, SRX4200 and SRX4600 allows a local attacker with low privileges to cause a complete Denial of Serv…

    Juniper Networks Junos OS Network devices

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-21088, EUVD-2026-21086, EUVD-2026-21091, EUVD-2026-21090, EUVD-2026-21085, EUVD-2026-21092, EUVD-2026-21080, EUVD-2026-21082, EUVD-2026-21078, EUVD-2026-21077, EUVD-2025-209396, EUVD-2026-21095, EUVD-2026-21206, EUVD-2026-21205, EUVD-2026-21204, EUVD-2026-21203, EUVD-2026-21201, EUVD-2026-21199, EUVD-2026-21197, EUVD-2026-21196, EUVD-2026-21195, EUVD-2025-209397, EUVD-2026-21093, EUVD-2026-21207, EUVD-2026-21193, EUVD-2026-21208

  2. #1

    Initiale Fassung

References