CVSS 9.8: Juniper SRX GRE Tunnel Flaw Lets Attackers Run Code as Root

Juniper Networks SRX Series devices running specific versions of Junos OS contain a critical vulnerability that allows unauthenticated remote code execution. The flaw, identified as CVE-2026-33792, exists within the srxpfe process. According to the National Vulnerability Database, the issue is a stack-based buffer overflow. An attacker can trigger this by sending a crafted packet through a configured GRE tunnel. This exposure permits the execution of code with root privileges or the induction of a denial of service.

Which Junos OS versions are affected?

The vulnerability impacts several release lines of Juniper Networks Junos OS. According to the NVD record, the flaw exists in versions before 23.2R2-S7.7. It also affects versions before 23.4R2-S8.13. Additionally, the issue is present in versions before 24.2R2-S5.5. The vulnerability extends to versions before 24.4R2-S5. Any organization running these specific older maintenance releases on their SRX Series hardware is exposed to this risk. Teams must verify their current software version against this list to determine their exposure level immediately.

How does the exploitation mechanism work?

The core weakness is classified as CWE-121, a stack-based buffer overflow. This occurs in the srxpfe process of Juniper Networks Junos OS on SRX Series. An unauthenticated network attacker can send a specially crafted packet to the device. This packet must be received on a configured GRE tunnel. The malformed data overflows the stack buffer, allowing the attacker to execute arbitrary code as the root user. Alternatively, the attacker can cause a denial of service. No authentication is required to initiate this attack vector.

What is the severity of this vulnerability?

The National Vulnerability Database rates CVE-2026-33792 as critical. One record lists a CVSS score of 9.8. Another record lists a slightly lower score of 9.3. Both scores fall within the critical range. The high severity stems from the unauthenticated nature of the attack and the potential for full system compromise. Remote attackers can gain root access, which provides complete control over the device. The ability to cause denial of service further amplifies the operational risk.

What mitigation steps are available?

The source material identifies specific version thresholds that resolve the issue. Organizations should upgrade to Junos OS 23.2R2-S7.7 or later. Upgrading to 23.4R2-S8.13 or later is also a valid mitigation path. For newer branches, moving to 24.2R2-S5.5 or later addresses the flaw. Similarly, upgrading to 24.4R2-S5 or later provides protection. If immediate patching is not possible, teams should consider disabling GRE tunnels if they are not essential for business operations. Restricting access to GRE tunnel endpoints can also reduce the attack surface until updates are applied.

Detection notes

Security operations teams should monitor for unusual traffic patterns on GRE tunnels. Look for spikes in packet errors or resets from the srxpfe process. Check system logs for unexpected process crashes or restarts. Monitor for outbound connections from the firewall to unknown external IP addresses. Verify that no new administrative sessions have been initiated. Review process memory usage for anomalies that might indicate buffer overflow attempts. Isolate affected devices from the network if malicious activity is confirmed. Preserve logs for forensic analysis.

Background: Buffer overflow vulnerabilities

A buffer overflow vulnerability causes a crash or exploit when a program writes more data into a fixed-size memory buffer than it can hold. This overwrites adjacent memory, including return addresses. Attackers manipulate this overflow to inject malicious code or redirect execution. The root cause is missing bounds checking during data input or processing.

Read the full guide: What Causes a Buffer Overflow Vulnerability: The Memory Logic Breakdown

What to do and how to stay safe: Juniper Networks

• Audit your inventory to identify all SRX Series devices running vulnerable Junos OS versions listed in the NVD record.
• Prioritize patching these devices to the specified maintenance releases to eliminate the stack-based buffer overflow vulnerability.
• Review GRE tunnel configurations to ensure they are only enabled where strictly necessary for business operations.
• Monitor network logs for anomalous traffic patterns on GRE interfaces that could indicate exploitation attempts.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this Juniper SRX vulnerability?

The vulnerability is identified as CVE-2026-33792.

Can an attacker exploit this flaw without credentials?

Yes, the vulnerability allows an unauthenticated network attacker to execute code or cause denial of service.

Which process on the SRX Series is affected?

The srxpfe process contains the stack-based buffer overflow vulnerability.