CVE-2026-33802: Juniper EX Series CLI Denial-of-Service via Missing Authorization

Technical summary

CVE-2026-33802 is a Missing Authorization vulnerability (CWE-862) affecting the Juniper Junos CLI on EX2300, EX4000, EX4100, EX4300-MP, and EX4400 switches. An authenticated local user can invoke a privileged 'request' command without holding the required permissions, triggering a complete traffic disruption. The vulnerability does not require elevated privilege class assignment—any authenticated session can execute the command, resulting in a Denial-of-Service condition that persists until automatic system recovery occurs. The CVSS 3.1 score of 5.5 (Medium) reflects local-only attack surface with high availability impact but no confidentiality or integrity breach.

Business impact

Organizations operating affected EX Series switches face unexpected network outages if insider threats or compromised local accounts execute the vulnerable CLI command. A single authenticated user—whether administrative staff, contractor, or account takeover—can render the switch inoperative, disrupting all traffic through that device and potentially cascading to dependent services. Recovery is automatic but may take minutes, during which connectivity is lost. This is particularly damaging in leaf-spine or core-access topologies where a single EX switch carries significant traffic load.

Affected systems

Juniper Junos OS on EX2300, EX4000, EX4100, EX4300-MP (Multigigabit), and EX4400 switches in the following versions are vulnerable: 23.2R2 before 23.2R2-S6; 23.4 before 23.4R2-S8; 24.2 before 24.2R2-S4; 24.4 before 24.4R2-S3; 25.2 before 25.2R2; and 25.4 before 25.4R1-S1. Verify your running version via 'show version' in the CLI.

Exploitability

Exploitability is constrained by the requirement for local, authenticated access—an attacker must already possess valid credentials and console or SSH connectivity to the switch. However, once authenticated, no additional privilege escalation is needed; the vulnerable command is executable by any authenticated user regardless of role assignment. This is a significant risk in environments with relaxed access controls, shared service accounts, or high user turnover. The attack is trivial to execute—a single command invocation triggers the DoS—and leaves minimal forensic evidence since the action appears legitimate within the authenticated session.

Remediation

Upgrade to patched Junos versions: 23.2R2-S6 or later for 23.2R2 branch; 23.4R2-S8 or later for 23.4 branch; 24.2R2-S4 or later for 24.2 branch; 24.4R2-S3 or later for 24.4 branch; 25.2R2 or later for 25.2 branch; or 25.4R1-S1 or later for 25.4 branch. In the interim, restrict CLI access via AAA policies—enforce role-based access control (RBAC) to limit which users can execute 'request' commands, and monitor for any execution of the vulnerable command against baseline profiles.

Patch guidance

Juniper has released security updates for all affected branches. Coordinate patching during maintenance windows to minimize traffic disruption. Test patches in a lab environment first to ensure compatibility with your deployment model and configuration. Verify patch installation by re-running 'show version' post-upgrade and confirm the version matches the patched release. If your version is not listed above, verify against the official Juniper advisory to identify the correct target patch level for your branch.

Detection guidance

Monitor Juniper switch logs and syslog for execution of the 'request' CLI command by non-administrative users or outside expected maintenance windows. Enable detailed CLI logging if available. Implement network segmentation to restrict local access to the CLI console port; disable unused serial/out-of-band management interfaces. Deploy role-based access control (RBAC) in your AAA system to ensure users can only execute permitted CLI commands. Alert on authentication to the management interface from unexpected source IPs or at unusual times. Consider NetFlow or sFlow monitoring to detect sudden traffic loss patterns that may indicate a successful DoS exploitation.

Why prioritize this

Although the CVSS score is medium and the attack requires local authentication, this vulnerability poses significant operational risk in environments where EX Series switches are critical infrastructure. The automatic, trivial-to-execute nature of the DoS, combined with minimal privilege requirements for an authenticated user, warrants prompt patching. Organizations with strict insider-threat programs or air-gapped management networks may assess risk as lower; those with shared service accounts or permissive access policies should prioritize patching immediately. Patch availability is already released, reducing delays.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) correctly reflects: Attack Vector Local (privileged network access required), Attack Complexity Low (no special conditions), Privileges Required Low (any authenticated user), User Interaction None, and high Availability Impact (complete traffic loss). The score does not account for insider threat likelihood or organizational context—security leaders should adjust prioritization based on their access control maturity and threat model. For organizations with weak RBAC or high-risk user populations, consider the practical risk higher than the numeric score suggests.

Frequently asked questions