CVE-2026-33789

Executive Summary

CVE-2026-33789 is a stack-based buffer overflow (CWE-121) in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated BGP peer can trigger the flaw by sending crafted BGP route updates to a device where the BGP Monitoring Protocol (BMP) is enabled, causing a denial of service and potentially achieving root-level command execution. With a CVSS base score of 9.8 and no available patch, this represents a critical risk to internet-facing BGP-speaking Juniper routers configured with BMP.

Technical Analysis

The vulnerability resides in the routing protocol daemon (rpd), the process responsible for all routing protocol operations on Junos OS and Junos OS Evolved. Per the NVD description, the flaw is a stack-based buffer overflow (CWE-121) that is reachable through crafted BGP route updates. The critical precondition is that the BGP Monitoring Protocol (BMP) is enabled on the target.

CWE-121 describes a condition in which data written to a fixed-length buffer allocated on the call stack exceeds its bounds, overwriting adjacent stack memory such as saved registers and return addresses. Because the corruption occurs on the stack, successful exploitation commonly leads to process crash (denial of service) and, under the right memory layout conditions, control-flow hijacking. The CVSS subscores (C:H/I:H/A:H) reflect that the vulnerable component runs with high privileges — rpd operates as a core system daemon with root-level privileges on Junos devices. Therefore, code execution within rpd is equivalent to root-level command execution on the routing platform.

The attack surface is BGP itself, specifically the update processing path that feeds data into BMP monitoring functions. BMP is used to stream BGP routing information to external monitoring collectors. The NVD description establishes that the overflow is triggered by crafted BGP route updates only when BMP is enabled, indicating the vulnerable code path is reached through the interaction between BGP update handling and BMP message construction or export. An attacker does not require authentication: a BGP peer relationship (or the ability to send BGP updates that reach the daemon) is sufficient. The network attack vector, low attack complexity, and no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N) are consistent with a remotely triggerable parsing/processing flaw in a routing protocol daemon.

No CNA title, affected version list, or patch information was provided with this advisory data. No public proof-of-concept, exploit code, or Nuclei template is known. Specific function names, buffer identifiers, or BMP message types involved in the overflow cannot be confirmed from the available description and are therefore not asserted here. The vulnerability class, remote unauthenticated trigger via BGP/BMP, and privilege context (rpd as root) are the confirmed technical facts.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (stack-based buffer overflow) and the conditions stated in the NVD description.

1. Reconnaissance/target identification: An adversary identifies Juniper Junos OS or Junos OS Evolved devices that are BGP-speaking and have BMP enabled. BGP peers are commonly reachable on TCP port 179; BMP collectors and peers may also be exposed. Devices at the edge of service provider or large enterprise networks are the most likely targets.

2. Triggering the flaw: The attacker establishes or leverages a BGP session and sends crafted BGP route updates. Because BMP is enabled, the update data flows into the vulnerable BMP-related processing path in rpd, where an oversized or malformed input overflows a fixed-length stack buffer (CWE-121). No authentication is required — reaching the daemon with attacker-controlled BGP update content is sufficient.

3. Payload/execution method (vulnerability-class level): A stack buffer overflow can overwrite adjacent stack memory. In the simplest case this crashes rpd, producing a denial of service. With precise control over the overwritten data, an attacker may influence control flow within rpd. Since rpd executes with root-level privileges, any code execution achieved in that process context yields root-level command execution on the device.

4. Post-exploitation impact: Successful exploitation could disable routing (rpd crash/restart), destabilizing network reachability for downstream networks and customers. If code execution is achieved, the attacker obtains root-level control of the routing platform, enabling persistent manipulation of routing, traffic interception, or use of the device as a foothold in the network core. The CVSS impact vector (C:H/I:H/A:H) reflects full loss of confidentiality, integrity, and availability.

Because the flaw is network-reachable, unauthenticated, and requires low complexity, exploitation attempts can be repeated and automated against exposed targets.

Impact Assessment

The CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) places this vulnerability in the Critical severity band. The attack is remotely launchable over the network with no authentication or user interaction and low complexity. Scope is unchanged, but the affected component — the routing protocol daemon running as root — means the blast radius extends far beyond a single process.

Business impact includes:

• Denial of service to routing infrastructure, with potential cascading outages across downstream networks and customers.
• Potential root-level compromise of Juniper routing platforms, granting attackers full control of a network core device.
• Integrity and confidentiality loss: routing tables, monitored BGP data (via BMP), and device configuration could be exposed or manipulated.
• Because BMP is the enabling condition, organizations that operate BMP monitoring pipelines — common in service providers and large enterprises — are disproportionately affected.

Affected systems are Juniper Networks Junos OS and Junos OS Evolved devices that run BGP with BMP enabled. Specific version ranges were not disclosed in the provided data and must be confirmed directly with the vendor. There is no CISA KEV listing and no confirmed in-the-wild exploitation at the time of writing, but the severity and lack of a patch make the exposure window open-ended.

Detection Guidance

Sigma Rule

title: Potential Juniper rpd Stack Buffer Overflow Exploitation via BGP/BMP
id: 8f3c1b2e-4a7d-4c9e-9b21-3d5e6f7a8b90
status: experimental
description: Detects anomalous rpd process crashes or restarts on Juniper Junos devices that may indicate exploitation of CVE-2026-33789 via crafted BGP route updates with BMP enabled.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-33789
author: Threat Intelligence Team
date: 2026/01/01
logsource:
  product: juniper
  service: junos
detection:
  selection_crash:
    message|contains:
      - 'rpd'
  selection_event:
    message|contains|all:
      - 'rpd'
    message|contains:
      - 'core dump'
      - 'signal 11'
      - 'signal 6'
      - 'segmentation fault'
      - 'restart'
      - 'panic'
  condition: selection_crash and selection_event
falsepositives:
  - Legitimate rpd restarts during maintenance or configuration commits
level: high
tags:
  - attack.t1190
  - cve.2026.33789

YARA Rule

rule CVE_2026_33789_Juniper_rpd_BGP_BMP
{
    meta:
        description = "Detects crash artifacts / core dumps referencing rpd and BMP associated with CVE-2026-33789"
        author = "Threat Intelligence Team"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-33789"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $rpd = "rpd" ascii wide
        $bmp = "BMP" ascii wide
        $bgp = "BGP" ascii wide
        $segv = "segmentation fault" ascii nocase
        $sig11 = "signal 11" ascii nocase
        $core = "core dump" ascii nocase
    condition:
        uint32be(0) == 0x7f454c46 or
        ($rpd and $bmp and 1 of ($segv, $sig11, $core)) or
        ($rpd and $bgp and 1 of ($segv, $sig11, $core))
}

Suricata IDS Rule

alert tcp any any -> any 179 (msg:"CVE-2026-33789 Juniper rpd BGP/BMP stack buffer overflow attempt (crafted BGP UPDATE)"; flow:established,to_server; content:"|ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff|"; depth:16; content:"|02|"; offset:18; depth:1; dsize:>400; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-dos; reference:cve,2026-33789; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-33789; sid:2026337890; rev:1;)

Elastic Detection

sequence by host.name with maxspan=5m
  [process where process.name == "rpd" and event.action == "start"]
  [process where process.name == "rpd" and event.action in ("crash", "signal", "exit") and process.exit_code != 0]

Splunk SPL Query

index=juniper sourcetype=junos:syslog
| search "rpd" ("core dump" OR "segmentation fault" OR "signal 11" OR "signal 6" OR "restart" OR "panic")
| stats count min(_time) as first_seen max(_time) as last_seen by host, message
| where count >= 2
| sort - count

Wazuh OSSEC Rule

<group name="juniper,junos,">
  <rule id="100789" level="12">
    <decoded_as>syslog</decoded_as>
    <match>rpd</match>
    <match>segmentation fault|signal 11|signal 6|core dump|panic</match>
    <description>CVE-2026-33789: Possible rpd stack buffer overflow / crash on Juniper Junos (BGP/BMP exploitation)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_33789,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• If BMP is not operationally required, disable it. The NVD description states the overflow is triggered when BMP is enabled; removing that precondition eliminates the described attack path.
• Restrict BGP peering to trusted, explicitly configured neighbors using authentication (TCP MD5 / BGP authentication) and prefix/inbound policy filters.
• Enforce control-plane firewall filters on edge interfaces to rate-limit and filter BGP (TCP/179) traffic, and block spoofed BMP (TCP/11019) traffic from untrusted sources.
• Monitor rpd for unexpected restarts or crashes and treat them as potential exploitation attempts.

2. Patch/upgrade steps:

• No vendor fix, workaround, or affected-version list was disclosed in the provided data. Organizations should monitor the Juniper Networks security advisories portal for a published Junos OS / Junos OS Evolved advisory and patched release addressing CVE-2026-33789, and apply it as soon as it is available. Do not assume any current version is unaffected until confirmed by the vendor.

3. Long-term hardening:

• Adopt BGP security best practices: route origin validation (RPKI/ROV), maximum-prefix limits, and strict inbound policy filters.
• Isolate or minimize exposure of the routing control plane to untrusted peers; avoid running BMP export to endpoints that bridge trust boundaries.
• Maintain redundant routing paths and rapid rpd-crash detection so a denial-of-service condition does not cascade.
• Track CVE-2026-33789 in vulnerability management tooling and re-evaluate patch status regularly until a fix is released.

References

• NVD — CVE-2026-33789: https://nvd.nist.gov/vuln/detail/CVE-2026-33789
• CWE-121 (Stack-based Buffer Overflow): https://cwe.mitre.org/data/definitions/121.html
• Juniper Networks Security Advisories (monitor for vendor advisory on this CVE): https://supportportal.juniper.net/s/global-search/%40uri
• CISA Known Exploited Vulnerabilities Catalog (check for future listing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (score not yet assigned at time of writing): https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-33789 in the provided data.