CVE-2026-33775

OVERVIEW CVE-2026-33775 is a memory leak vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS affecting MX Series routers. When the authentication packet-type option is configured and received packets fail to match the specified packet type, the daemon fails to release allocated memory. This memory exhaustion prevents new subscribers from logging in once available heap memory is depleted. The vulnerability impacts multiple Junos OS versions across several release branches, with patched versions available for 22.4, 23.2, 23.4, 24.2, 24.4, and 25.2 series. SEVERITY The vulnerability carries a CVSS score of 6.5 (Medium) with an adjacent network attack vector requiring no authentication or user interaction. Attack complexity is low, meaning an unauthenticated attacker positioned on the local network can trigger the memory leak reliably. The impact is limited to availability, as the attack causes service denial by exhausting daemon memory resources rather than compromising confidentiality or integrity. The EPSS score of 0.00028 indicates minimal real-world exploitation activity relative to other vulnerabilities. EXPLOITATION STATUS There is no evidence of active exploitation, and the vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog. No publicly available exploit code has been reported. The relatively low FAUCET Risk Score of 44.0 and inactive status on security hot lists suggest limited community and threat actor attention, though organizations running vulnerable versions should apply available patches to maintain operational resilience.