External risk intelligence

Juniper Junos OS BGP Stack Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-33789

The vulnerability affects the BGP routing daemon, which typically operates on infrastructure-level edge routers. While these devices are internet-facing, BGP peers are usually restricted to known, authorized network partners and are typically protected by access control lists or direct peering agreements rather than open, public internet access. Consequently, while reachable, it is not a public-facing web service.

Buffer Overflow

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Juniper Networks' Junos OS routing protocol daemon. The issue could allow an unauthenticated external network peer to disrupt service or gain control of affected systems, particularly when a specific monitoring protocol is active. The primary concern is to confirm if the affected technology is in use and assess potential exposure.

Unauthenticated BGP peers can cause disruption or gain control.
Affects critical network infrastructure routing.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker with a network connection could exploit this vulnerability by sending specially crafted BGP route updates to a Juniper device. This is possible when the BGP Monitoring Protocol (BMP) is enabled, allowing the attacker to target the routing protocol daemon. Successful exploitation could lead to a denial of service and potentially allow the attacker to execute commands with root privileges.

Entry condition: Unauthenticated BGP peer.
Trigger point: Crafted BGP route updates.
Resulting risk: Denial of service, command execution.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated BGP peer could trigger a stack-based buffer overflow in the Juniper Networks routing protocol daemon. This could lead to a denial of service, and potentially allow for the execution of commands with root privileges on affected systems, but only when the BGP Monitoring Protocol is enabled.

Routing protocol daemon data at risk.
Crafted BGP updates could trigger overflow.
Denial of service and command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved is affected by a critical vulnerability if the BGP Monitoring Protocol (BMP) is enabled. This requires identifying all instances of the affected technology, confirming their business criticality and exposure to unauthenticated BGP peers, and then coordinating remediation with infrastructure and network security teams.

Network and infrastructure teams own remediation.
Verify BMP configuration and external BGP peer reachability.
Plan remediation during scheduled maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Juniper Junos OS and its routing protocol daemon?

Junos OS is the operating system powering Juniper Networks' infrastructure devices, such as edge routers. The routing protocol daemon (rpd) acts as the central engine for these devices, managing complex network traffic paths and exchange processes between routers. It ensures data packets reach their intended destinations efficiently across large-scale enterprise and service provider networks.

What does CWE-121 mean for CVE-2026-33789?

CWE-121 refers to a stack-based buffer overflow. This happens when a program writes more data to a memory buffer on the stack than it can hold, overwriting adjacent memory. In this CVE, the routing daemon fails to properly handle data in crafted BGP route updates, potentially allowing an attacker to corrupt memory and execute unauthorized commands with root-level privileges.

How is this BGP vulnerability triggered?

An attacker triggers this by sending malformed BGP route updates to a targeted Juniper device. Critically, this vulnerability only presents a risk when the BGP Monitoring Protocol (BMP) is active on the system. If BMP is disabled, the specific code path containing the flawed memory handling is not exercised, meaning the vulnerability cannot be exploited through this vector.

Is my device at risk per Halo Surface Signal?

While the routing daemon resides on infrastructure often reachable via the internet, Halo Surface Signal notes that BGP peers are usually restricted to known, authorized partners. Your actual risk depends on whether you have BMP enabled and if your BGP peer relationships are limited to trusted entities via access control lists, rather than being exposed to the general public internet.

What should I do if I run affected Juniper systems?

First, inventory your systems to identify where Junos OS is running and confirm if the BGP Monitoring Protocol (BMP) is currently enabled. If BMP is active, coordinate with your network engineering team to assess the necessity of this feature and prioritize remediation through official vendor updates during your next scheduled maintenance window.

References

supportportal.juniper.net/JSA112187

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.