CVE-2026-33774: Junos OS: MX Series: Firewall filters on lo0.<non-0> in the default routing instance are not in effect

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-09 · updated 2026-10-26
Weakness: CWE-754

Description

An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass the configured firewall filter and access the control-plane of the device. On MX platforms with MPC10, MPC11, LC4800 or LC9600 line cards, and MX304, firewall filters applied on a loopback interface lo0.n (where n is a non-0 number) don't get executed when lo0.n is in the global VRF / default routing-instance. An affected configuration would be: user@host# show configuration interfaces lo0 | display set set interfaces lo0 unit 1 family inet filter input <filter-name> where a firewall filter is applied to a non-0 loopback interface, but that loopback interface is not referred to in any routing-instance (RI) configuration, which implies that it's used in the default RI. The issue can be observed with the CLI command: user@device> show firewall counter filter <filter_name> not showing any matches. This issue affects Junos OS on MX Series: * all versions before 23.2R2-S6, * 23.4 versions before 23.4R2-S7, * 24.2 versions before 24.2R2, * 24.4 versions before 24.4R2.

Affected products

Juniper Junos OS: before 23.2; 23.2-r1, 23.2-r1-s1, 23.2-r1-s2, 23.2-r2, 23.2-r2-s1, 23.2-r2-s2 (+19) — fixed in 23.2

How to fix

Upgrade to a fixed version: Juniper Junos OS 23.2. Check the vendor advisory for mitigations.

References

https://kb.juniper.net/JSA107865

Get alerted when CVE-2026-33774 or the next vulnerability affects your stack