CVE-2026-33794: Juniper PTX Junos OS Evolved evo-aftmand DoS Vulnerability

Technical summary

CVE-2026-33794 is an improper exception-handling vulnerability (CWE-754) in the Juniper evo-aftmand daemon responsible for advanced forwarding operations on PTX Packet Forwarding Engines. The vulnerability stems from insufficient validation when processing unilist ECMP routing updates. Unilist ECMP is an optimization where multiple equal-cost routes consolidate into a single unified next-hop list; during bulk routing churn or specific update sequences, the daemon fails to detect an exceptional condition, resulting in heap or data structure corruption. This triggers an evo-aftmand-bx core dump, requiring FPC restart or full system reboot for recovery. The CVSS 3.1 score of 5.9 (Medium) reflects high attack complexity (AC:H), network-based accessibility (AV:N), and availability impact, with no confidentiality or integrity consequences.

Business impact

For organizations operating Juniper PTX routers as core or edge routing platforms, this vulnerability creates a targeted denial-of-service risk. An attacker capable of injecting or manipulating BGP/IGP routing updates—whether through route hijacking, an upstream compromise, or internal network access—can force router outages without authentication. Affected sites experience traffic disruption, with recovery requiring manual intervention (reboot/FPC restart) rather than automatic failover. The impact is particularly acute for networks with limited redundancy or those reliant on PTX platforms for critical traffic engineering. Large ECMP deployments are at higher risk due to the specific reliance on unilist optimization.

Affected systems

Juniper Junos OS Evolved on the following PTX platforms and software versions: PTX Series routers including PTX3000, PTX5000, PTX1000-72Q, PTX10000, PTX10001, PTX10001-36MR, PTX100016, PTX10002, PTX10002-36QDD, PTX10002-60C, PTX10003 variants, PTX10004, PTX10008, PTX10016, and PTX12008. Vulnerable software branches are: Junos OS Evolved 24.4R2-EVO before 24.4R2-S3-EVO, and Junos OS Evolved 25.2 before 25.2R2-EVO. Verify your platform and release against Juniper's official advisory for exact version applicability.

Exploitability

Exploitation requires network-based access (no authentication needed) and the ability to generate continuous routing updates—either direct BGP/IGP injection or indirect manipulation through route origin spoofing. The CVSS attack complexity is high (AC:H) because the crash depends on a sequence of routing state conditions largely outside the attacker's control: the timing and composition of ECMP unilist updates must align to trigger corruption. However, in environments with active routing dynamics or large ECMP fabrics, trigger conditions may occur naturally or semi-reliably. There is no evidence of weaponized exploits, and the vulnerability does not appear on CISA's KEV list. An attacker with sustained network presence and routing manipulation capability can likely cause repeated or prolonged outages.

Remediation

Apply Juniper-provided security patches immediately: upgrade to Junos OS Evolved 24.4R2-S3-EVO or later for the 24.4R2 branch, or 25.2R2-EVO or later for the 25.2 branch. Verify patch versions against Juniper's security advisory. If patching cannot be completed immediately, implement network-based mitigations: restrict BGP/IGP update sources to trusted neighbors only, enable route filtering and validation (RPKI/route origin validation where applicable), and monitor for abnormal routing churn. Network segmentation and access controls on routing protocol adjacencies reduce attack surface. Note that no workaround eliminates the underlying flaw; patching is required.

Patch guidance

Juniper has released security patches for affected branches. For Junos OS Evolved 24.4R2-EVO, upgrade to 24.4R2-S3-EVO or a later stable release in the 24.4 series. For Junos OS Evolved 25.2, upgrade to 25.2R2-EVO or later. Before applying patches, verify current version with 'show version' and consult Juniper's release notes to ensure compatibility with your configuration and any dependent modules. Schedule patching during a maintenance window to allow for FPC or system restart if needed. Test patches in a non-production environment if possible. Verify that evo-aftmand is stable post-upgrade by monitoring system logs for aftmand-bx core dumps.

Detection guidance

Monitor PTX platforms for the following signals: (1) Unexpected evo-aftmand process crashes or aftmand-bx core files in /var/crash/ or syslog, especially correlated with periods of high routing churn or ECMP updates; (2) sudden FPC restarts or 'PFE rebooted' messages without administrative action; (3) BGP/IGP session flaps or rapid routing table changes from external sources; (4) unusual incoming routing update volume from neighbors, especially if crafted to exercise ECMP unilist paths. Enable core dump capture on the PFE and retain logs spanning the crash window. Correlate with netflow or syslog ingestion to identify external routing manipulation patterns. Check for unauthorized BGP session establishment or route injection from unexpected peers.

Why prioritize this

While the CVSS score is Medium (5.9), the vulnerability warrants prompt attention because: (1) it requires no authentication, (2) it directly impacts service availability on critical infrastructure (carrier-grade routers), (3) affected versions are current or recent, (4) the attack vector (network routing) is common and difficult to eliminate entirely, and (5) recovery is manual and disruptive. Organizations with large ECMP deployments or those dependent on PTX routers for redundancy should prioritize patching. However, the high attack complexity and requirement for specific routing state sequences means this is not an immediate critical threat for all users—lower risk if routing sources are strictly controlled.

Risk score, explained

CVSS 3.1 score of 5.9 reflects: Network-based vector (AV:N) with no authentication (PR:N), High attack complexity (AC:H) because exploitation depends on triggering a specific sequence of ECMP unilist updates outside attacker control, no impact to confidentiality or integrity (C:N, I:N), and High availability impact (A:H) due to process crash requiring manual intervention. The Medium severity is justified by the limitation that triggering the flaw is not straightforward or reliable; however, the accessibility and service impact keep it elevated above Low. In environments with strict routing controls, risk is lower; in open or dynamic routing fabrics, risk is higher.

Frequently asked questions