CVE-2026-33773 Security feature bypass in Junos OS

Medium 6.9 Published 9 Apr 2026 Updated 13 Apr 2026

An attacker can bypass egress filters on specific Juniper switches if identical filters are applied to both IRB and physical interfaces, allowing blocked traffic to pass.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-33773?

CVE-2026-33773 is a medium-severity vulnerability in Juniper Junos, published on 9 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An Incorrect Initialization of Resource vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series and QFX Series device allows an unauthenticated, network-based attacker to cause an integrity impact to downstream networks.

When the same family inet or inet6 filter is applied on an IRB interface and on a physical interface as egress filter on EX4100, EX4400, EX4650 and QFX5120 devices, only one of the two filters will be applied, which can lead to traffic being sent out one of these interfaces which should have been blocked.

This issue affects Junos OS on EX Series and QFX Series: * 23.4 version 23.4R2-S6, * 24.2 version 24.2R2-S3.

No other Junos OS versions are affected.

Weakness: CWE-1419

Which versions are affected by CVE-2026-33773?

It affects 1 product.

Products include Juniper Junos.

How do I fix CVE-2026-33773?

No fix has been published for CVE-2026-33773 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-33773 being exploited?

There is no known exploitation of CVE-2026-33773 in the wild and no public exploit code.

All Juniper Junos vulnerabilities

Sources

Also known as GHSA-m7p5-cqg5-94p6.