CVE-2026-33797

OVERVIEW CVE-2026-33797 is an improper input validation vulnerability in Juniper Networks Junos OS and Junos OS Evolved that allows an unauthenticated, adjacent attacker to trigger denial of service by sending a specially crafted BGP packet over an established BGP session. The vulnerability affects Junos OS version 25.2 prior to 25.2R2 and Junos OS Evolved version 25.2-EVO prior to 25.2R2-EVO. Both eBGP and iBGP implementations are vulnerable across IPv4 and IPv6 protocols. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.4 (High) with an adjacent network attack vector, low attack complexity, and no authentication requirements. The impact is limited to availability, as successful exploitation only causes denial of service through BGP session resets. An attacker can sustain the DoS by repeatedly sending the malicious packet, though the attack requires an established BGP session and network adjacency, which limits the affected scope within network environments. EXPLOITATION STATUS There is no indication of active exploitation or public exploit code availability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and it remains inactive on security vendor hot lists. The low EPSS score of 0.00035 suggests minimal likelihood of widespread exploitation in the near term.