CVE-2026-33785

A Missing Authorization vulnerability (CVE-2026-33785) affects Juniper Networks Junos OS on MX Series devices, allowing authenticated local users with low privileges to execute restricted CLI commands designated for high-privilege administrators and Juniper Device Manager operations. The vulnerability impacts Junos OS 24.4 releases before 24.4R2-S3 and 25.2 releases before 25.2R2, with no impact on releases prior to version 24.4. The vulnerability carries a CVSS score of 8.8 (HIGH) with a local attack vector and low complexity requirement. Once authenticated to the device, a low-privilege user can execute 'request csds' commands without additional authorization checks, achieving high impact across confidentiality, integrity, and availability of managed devices. The attack requires local access and low privileges but results in complete compromise of the managed infrastructure. Exploitation status remains minimal at present, with no public exploit code available and no indication of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) list and remains inactive on industry hot lists, suggesting limited community attention and exploitation attempts to date. Organizations should still prioritize patching given the high severity rating and the ease of exploitation for any authenticated local user.