Key points
- The flaw is a stack-based buffer overflow in the srxpfe process of Juniper Networks Junos OS.
- Attackers need no authentication to exploit the vulnerability through a configured GRE tunnel.
- Successful exploitation grants root-level code execution or causes a denial of service.
Security researchers have identified a critical vulnerability in Juniper Networks SRX Series firewalls that allows unauthenticated attackers to execute arbitrary code with root privileges. The flaw, tracked as CVE-2026-33792, resides within the srxpfe process and can be triggered by sending a single crafted packet to a configured Generic Routing Encapsulation (GRE) tunnel.
The vulnerability is rated as critical by the National Vulnerability Database, with a CVSS score of 9.8. It stems from a stack-based buffer overflow weakness, classified under CWE-121. An attacker does not need valid credentials or prior access to the network infrastructure to exploit this issue. By transmitting a maliciously formed packet to the GRE tunnel interface, they can either gain full control of the firewall or disrupt its operation entirely.
Scope of the vulnerability
The issue affects multiple release lines of Juniper Networks Junos OS running on SRX Series hardware. According to the NVD record, versions prior to 23.2R2-S7.7 are vulnerable. Similarly, systems running versions before 23.4R2-S8.13, before 24.2R2-S5.5, and before 24.4R2-S5 are also at risk. Organisations using these specific software versions must verify their current patch levels immediately to determine if they fall within the affected range.
What happens next
Organisations should update their Juniper Networks Junos OS installations to the specified fixed versions to mitigate this risk. The NVD record indicates that versions 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, and 24.4R2-S5 address the vulnerability. Security teams should prioritise patching devices that expose GRE tunnels to untrusted networks. Monitoring for signs of exploitation remains important while updates are deployed across the infrastructure.
Why this attack works
Stack-based buffer overflows occur when a program writes more data to a fixed-size memory buffer than it can hold. This overflow corrupts adjacent memory, often allowing an attacker to overwrite return addresses or function pointers. In intrusion scenarios, this technique serves the initial compromise stage, bypassing authentication to gain high-privilege access. Teams usually monitor for anomalous traffic patterns on tunnel interfaces, as this flaw relies on specific packet structures rather than standard application-layer interactions.
What to do and how to stay safe: Juniper Networks
- Verify the Junos OS version on all SRX Series devices against the affected list provided by the NVD.
- Review firewall configurations to identify any GRE tunnels exposed to untrusted or external networks.
- Monitor system logs for unusual process behaviour or crashes originating from the srxpfe process.
- Apply the vendor-provided updates to reach the fixed versions listed in the advisory.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-33792?
The National Vulnerability Database rates the severity as critical with a CVSS score of 9.8.
Which Juniper products are affected by this vulnerability?
Juniper Networks SRX Series firewalls running specific versions of Junos OS are affected.
Can an attacker exploit this flaw without credentials?
Yes, the vulnerability allows unauthenticated network attackers to execute code or cause denial of service.
