CVE-2026-33794

{"id": "CVE-2026-33794", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33794", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-10T14:22:12.408693Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "sirt@juniper.net", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "sirt@juniper.net", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 8.2, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Green", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "GREEN", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "sirt@juniper.net", "affectedData": [{"vendor": "Juniper Networks", "product": "Junos OS Evolved", "versions": [{"status": "affected", "version": "24.4R2-EVO", "lessThan": "24.4R2-S3-EVO", "versionType": "custom"}, {"status": "affected", "version": "25.2", "lessThan": "25.2R2, 25.2R2-EVO", "versionType": "custom"}], "platforms": ["PTX Series"], "defaultStatus": "unaffected"}]}], "published": "2026-07-09T21:16:54.790", "references": [{"url": "https://supportportal.juniper.net/JSA110073", "tags": ["Mitigation", "Vendor Advisory"], "source": "sirt@juniper.net"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "sirt@juniper.net", "description": [{"lang": "en", "value": "CWE-754"}]}], "descriptions": [{"lang": "en", "value": "An Improper Check for Unusual or Exceptional Conditions vulnerability in the \n\nadvanced forwarding toolkit (evo-aftmand)\n\n of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated network-based attacker generating continuous routing updates, resulting in unilist ECMP routes, to crash the \n\nevo-aftmand process on the PFE, leading to a Denial-of-Service (DoS). The conditions required for successful exploitation are\u00a0based on a sequence of events that are outside an attacker's direct control.\n\nUnified list (unilist) ECMP routes are a specific ECMP behavior where multiple equal-cost routes share a single logical next-hop list entry. The router treats them as one route with multiple next hops and load balances traffic across that unified list. Due to an issue processing unilist ECMP routing updates, internal state corruption may occur, especially in large-scale ECMP unilist deployments, leading to the evo-aftmand process crashing, resulting in an evo-aftmand-bx core. Manual intervention is required to recover by rebooting the system or\u00a0restarting the FPC.\n\nThis issue affects Junos OS Evolved on PTX :\n\n\n * from 24.4R2-EVO before 24.4R2-S3-EVO;\n * from 25.2 before 25.2R2-EVO."}, {"lang": "es", "value": "Una vulnerabilidad de comprobaci\u00f3n incorrecta de condiciones inusuales o excepcionales en el kit de herramientas de reenv\u00edo avanzado (evo-aftmand) de Juniper Networks Junos OS Evolved en la serie PTX permite a un atacante no autenticado basado en red que genera actualizaciones de enrutamiento continuas, lo que resulta en rutas ECMP de lista unificada, bloquear el proceso evo-aftmand en el PFE, lo que lleva a una denegaci\u00f3n de servicio (DoS). Las condiciones necesarias para una explotaci\u00f3n exitosa se basan en una secuencia de eventos que est\u00e1n fuera del control directo de un atacante.\n\nLas rutas ECMP de lista unificada (unilist) son un comportamiento ECMP espec\u00edfico donde m\u00faltiples rutas de igual coste comparten una \u00fanica entrada l\u00f3gica de lista de siguiente salto. El router las trata como una ruta con m\u00faltiples siguientes saltos y equilibra la carga del tr\u00e1fico a trav\u00e9s de esa lista unificada. Debido a un problema al procesar las actualizaciones de enrutamiento ECMP de lista unificada, puede producirse una corrupci\u00f3n del estado interno, especialmente en implementaciones ECMP de lista unificada a gran escala, lo que lleva al bloqueo del proceso evo-aftmand, resultando en un core evo-aftmand-bx. Se requiere intervenci\u00f3n manual para recuperarse reiniciando el sistema o el FPC.\n\nEste problema afecta a Junos OS Evolved en PTX:\n\n* desde 24.4R2-EVO anterior a 24.4R2-S3-EVO;\n* desde 25.2 anterior a 25.2R2-EVO."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.4:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25DA0DD2-E974-448C-BD05-ED6FCA4725FB"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5F6F47F-0C86-4554-8517-A6A0CD29B3B0"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8EDB7A3C-D1F5-4D24-8B8C-F104EC8C7D42"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:25.2:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DAF96553-DB70-4DFA-8658-306A7477DD06"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:25.2:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83C415EF-E87B-4259-A836-59B3A9C3914B"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:25.2:r1-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AFD32E67-9D8D-437D-96BC-CA97A1F686BA"}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:25.2:r1-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E5D9967-1B53-427B-9B23-77DC399F3D71"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:juniper:ptx1000-72q:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B219F54A-4474-48CB-80F1-D988A719C3DA"}, {"criteria": "cpe:2.3:h:juniper:ptx10000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "249F6266-4ED6-4464-9347-9322E1481D0D"}, {"criteria": "cpe:2.3:h:juniper:ptx10001:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6CDCCB33-D428-4D64-977E-71C62F89AE5A"}, {"criteria": "cpe:2.3:h:juniper:ptx10001-36mr:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C188428C-0558-44FB-845C-E885DE9A0733"}, {"criteria": "cpe:2.3:h:juniper:ptx100016:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "37F94757-34CE-4F88-A6D3-544FE6A476D5"}, {"criteria": "cpe:2.3:h:juniper:ptx10002:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "82B22AC2-B794-4F12-9EB3-9AA6E4B19831"}, {"criteria": "cpe:2.3:h:juniper:ptx10002-36qdd:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F805FE65-289B-404D-87A3-289A4A9AC927"}, {"criteria": "cpe:2.3:h:juniper:ptx10002-60c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1B5462DF-5CF1-4DF9-989B-622EA734964F"}, {"criteria": "cpe:2.3:h:juniper:ptx10003:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5BD05415-9F94-4EB8-805A-C9C0FFA9D0DF"}, {"criteria": "cpe:2.3:h:juniper:ptx10003_160c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B1E88A41-B158-4A66-9DFD-438931C6BE68"}, {"criteria": "cpe:2.3:h:juniper:ptx10003_80c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2C97FFB5-8755-474B-ABCF-98DC7659208E"}, {"criteria": "cpe:2.3:h:juniper:ptx10003_81cd:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FAECB1BF-0F3A-4AD9-AF6B-E54A13D9D804"}, {"criteria": "cpe:2.3:h:juniper:ptx10004:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C432E543-37F5-4CA0-B239-2B97C6A16907"}, {"criteria": "cpe:2.3:h:juniper:ptx10008:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "65A64A26-4606-4D33-8958-5A3B7FFC4CDB"}, {"criteria": "cpe:2.3:h:juniper:ptx10016:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1879799F-18B2-4958-AA90-FD19348C889F"}, {"criteria": "cpe:2.3:h:juniper:ptx12008:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "90D4D075-6304-47C8-8F2C-6F5DB4617DBD"}, {"criteria": "cpe:2.3:h:juniper:ptx3000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "516476F9-7D4C-494F-99AA-750F4467CD15"}, {"criteria": "cpe:2.3:h:juniper:ptx5000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "654140A0-FEC0-4DB4-83BF-ECCB000DFA4D"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "sirt@juniper.net"}