External risk intelligence

Juniper Junos OS SRX GRE Tunnel Stack Buffer Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-33792

The vulnerability exists in Junos OS on SRX Series devices, which are commonly deployed as edge gateways and network security appliances. Because these devices are frequently positioned at the network perimeter to process tunnel traffic, the GRE tunnel interface is often reachable from public-facing or external network segments.

Buffer Overflow

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Juniper Networks Junos OS affecting SRX Series devices. This issue, stemming from a buffer overflow within the srxpfe process, could allow an unauthenticated attacker to execute code or cause a denial of service by sending a specially crafted packet over a configured GRE tunnel. The potential for remote code execution and service disruption warrants attention, particularly given the common deployment of SRX devices at network perimeters.

Unauthenticated attackers could gain control or disrupt services.
This impacts network edge devices, a critical security layer.
Confirm relevance and exposure within our SRX deployments.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can target Juniper Networks SRX Series devices by sending specially crafted packets over a configured GRE tunnel. This allows the attacker to reach the vulnerable srxpfe process, potentially leading to code execution with root privileges or a denial of service.

Entry condition: Network exposure via GRE tunnel.
Trigger point: Sending a crafted GRE tunnel packet.
Resulting risk: Root code execution or denial of service.

Live Threat

Current exploitation, exposure, and threat context

A stack-based buffer overflow vulnerability in the srxpfe process could allow an unauthenticated attacker to execute code as root or cause a denial of service when a crafted packet is received on a configured GRE tunnel.

Root code execution or denial of service.
Crafted GRE tunnel packets may trigger overflow.
Compromised device or service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

Network and security teams are likely responsible for addressing this vulnerability, given its presence in Juniper Networks SRX Series devices used for network perimeter security. The initial step should involve identifying all deployed SRX Series devices, confirming their exposure to the internet or untrusted networks, and determining if they are configured with GRE tunnels. Subsequently, engage with the accountable owner to plan remediation based on the identified risk and business criticality.

Network and security teams own remediation.
Verify GRE tunnel configuration and exposure.
Plan for planned maintenance or vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Juniper Junos OS on SRX Series?

Junos OS is the networking operating system that powers Juniper's hardware. The SRX Series are high-performance security gateways and firewalls used to route traffic and enforce security policies at the network edge. These devices act as critical traffic controllers, often managing complex connections like GRE tunnels to link different network segments securely.

What does CWE-121 mean for CVE-2026-33792?

CWE-121 refers to a stack-based buffer overflow. In plain terms, this means the software does not properly check the size of incoming data before writing it to a specific memory area called the stack. If an attacker sends a carefully formatted, oversized packet, they can overwrite adjacent memory, which may lead to unauthorized code execution with root-level privileges or crash the system.

How is this vulnerability triggered?

The flaw is triggered when the srxpfe process receives a malicious packet specifically designed for a GRE tunnel. If a GRE tunnel is not configured on the SRX device, the vulnerable code path responsible for processing these specific packets is not exercised, which prevents the overflow condition from occurring.

Do I need to worry if my device is internal?

Halo Surface Signal indicates that because SRX devices often act as edge gateways, they are frequently positioned at the network perimeter. While internet-facing devices are the primary concern, internal devices with GRE tunnels remain potentially reachable if an attacker has established a presence elsewhere on your internal network.

How should I respond to this vulnerability?

Begin by auditing your environment to locate all SRX Series devices. Determine which of these are currently configured with GRE tunnels. Once identified, prioritize these systems for remediation by following official vendor guidance, coordinating with your internal network security team to schedule necessary maintenance or configuration changes.

References

supportportal.juniper.net/JSA112186

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.