CVE-2026-33776: Junos OS and Junos OS Evolved: Specific low privileged CLI command exposes sensitive information

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-09 · updated 2026-10-26
Weakness: CWE-862

Description

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a local user with low privileges to read sensitive information. A local user with low privileges can execute the CLI command 'show mgd' with specific arguments which will expose sensitive information. This issue affects Junos OS: * all versions before 22.4R3-S8, * 23.2 versions before 23.2R2-S6, * 23.4 versions before 23.4R2-S6, * 24.2 versions before 24.2R2-S4, * 24.4 versions before 24.4R2-S1, * 25.2 version before 25.2R1-S2, 25.2R2; Junos OS Evolved: * all versions before 23.2R2-S6-EVO, * 23.4 version before 23.4R2-S6-EVO, * 24.2 version before 24.2R2-S4-EVO, * 24.4 versions before 24.4R2-S1-EVO, * 25.2 versions before 25.2R2-EVO.

Affected products

Juniper Junos OS: before 22.4; 22.4, 22.4-r1, 22.4-r1-s1, 22.4-r1-s2, 22.4-r2, 22.4-r2-s1 (+46) — fixed in 22.4
Juniper Networks Junos OS Evolved: before 23.2; 23.2, 23.2-r1, 23.2-r1-s1, 23.2-r1-s2, 23.2-r2, 23.2-r2-s1 (+30) — fixed in 23.2

How to fix

Upgrade to a fixed version: Juniper Junos OS 22.4; Juniper Networks Junos OS Evolved 23.2. Check the vendor advisory for mitigations.

References

https://kb.juniper.net/JSA107866

Get alerted when CVE-2026-33776 or the next vulnerability affects your stack