CVE-2026-33779: Junos OS: SRX Series: Insufficient certificate verification for device to SD cloud communication

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-09 · updated 2026-10-26
Weakness: CWE-296

Description

An Improper Following of a Certificate's Chain of Trust vulnerability in J-Web of Juniper Networks Junos OS on SRX Series allows a PITM to intercept the communication of the device and get access to confidential information and potentially modify it. When an SRX device is provisioned to connect to Security Director (SD) cloud, it doesn't perform sufficient verification of the received server certificate. This allows a PITM to intercept the communication between the SRX and SD cloud and access credentials and other sensitive information. This issue affects Junos OS: * all versions before 22.4R3-S9, * 23.2 versions before 23.2R2-S6, * 23.4 versions before 23.4R2-S7, * 24.2 versions before 24.2R2-S3, * 24.4 versions before 24.4R2-S2, * 25.2 versions before 25.2R1-S2, 25.2R2.

Affected products

Juniper Junos OS: before 22.4; 22.4, 22.4-r1, 22.4-r1-s1, 22.4-r1-s2, 22.4-r2, 22.4-r2-s1 (+48) — fixed in 22.4

How to fix

Upgrade to a fixed version: Juniper Junos OS 22.4. Check the vendor advisory for mitigations.

References

https://kb.juniper.net/JSA107823

Get alerted when CVE-2026-33779 or the next vulnerability affects your stack