CVE-2026-33796

Executive Summary

CVE-2026-33796 is a stack-based buffer overflow (CWE-121) in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved, reachable through BGP Monitoring Protocol (BMP) route monitoring. A configured external BGP neighbor — meaning an attacker who can establish or is already party to a configured BGP peering session — can trigger the flaw remotely to execute arbitrary commands with root privileges. With a CVSS v3.1 base score of 9.8, this is a critical, network-reachable, unauthenticated-from-the-session-perspective code execution defect in a core routing control-plane daemon, and no patch, workaround, or public proof-of-concept currently exists.

Technical Analysis

The vulnerability resides in the routing protocol daemon (rpd), the process in Junos OS that implements routing protocols including BGP and BGP Monitoring Protocol (BMP). BMP is a mechanism by which a router streams BGP route data to a monitoring station; within this architecture, rpd acts as the BMP sender/station-side endpoint that sends monitored route information to configured BMP monitoring targets. The defect is classified as a stack-based buffer overflow (CWE-121), which means a fixed-size stack buffer is populated with attacker-influenced data whose length is not adequately validated before the copy, allowing the overflow to clobber adjacent stack memory such as saved registers and return addresses.

The NVD description states the flaw is reachable "via BMP route monitoring" and is triggerable by "a configured external BGP neighbor." This indicates the attack surface is not the general internet but the BGP control plane: the attacker must be a BGP neighbor that the target device is configured to peer with, and the malformed input is delivered in the context of BMP route monitoring processing. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms network exploitability, low attack complexity, no privileges required, no user interaction, and high confidentiality, integrity, and availability impact, with the vulnerable component treated as a single security authority.

Because the flaw is a memory-safety defect in a daemon that runs with elevated privileges (rpd executes with root privileges as stated in the description), successful corruption of stack memory can be leveraged to redirect control flow and execute arbitrary commands in the context of the routing protocol daemon. The specific function, buffer, input field, and length parameter involved in the overflow are not enumerated in the available CVE description — no function names, source file paths, or protocol field names should be assumed beyond "rpd," "BGP," and "BMP route monitoring," which appear verbatim. Precise root-cause detail (which BMP message element overflows which stack buffer) is not available and is left unstated rather than fabricated.

Exploitation Scenarios

The following attack chain is inferred at the vulnerability-class level from the NVD description; no public proof-of-concept or exploit code is available, and no specific code patterns are asserted.

1. Reconnaissance / target identification. The attacker identifies a Juniper device running vulnerable Junos OS or Junos OS Evolved that has BGP configured with the attacker's autonomous system as an external neighbor, and that has BMP route monitoring enabled and directed at a monitoring target the attacker can influence. Because exploitation requires being a configured BGP neighbor, the realistic targeting model is a peer, a compromised or hostile upstream/transit neighbor, or an actor who can inject on the BGP session path rather than an arbitrary internet host.

2. Triggering the flaw class. Once the BGP session is established (as a configured external BGP neighbor), the attacker sends crafted data that is processed while the device performs BMP route monitoring. The malformed input causes a copy into a fixed-size stack buffer without a bounds check, producing a stack-based buffer overflow in rpd. This is a memory-corruption trigger: the oversized data writes past the boundary of the stack buffer.

3. Payload / execution method (at class level). Because the overflow is on the stack, the attacker's crafted data can overwrite saved control data such as a return address; when the affected rpd code path returns, control flow is redirected to attacker-controlled content. Successful redirection yields arbitrary command execution. The description states the commands execute "with root privileges," i.e., in the security context of the routing protocol daemon. The exact payload construction is not described in the available data and is not asserted here.

4. Post-exploitation impact. With arbitrary root-level command execution in rpd on a routing platform, an attacker can achieve full device compromise of the routing control plane, alter or blackhole routing, exfiltrate configuration and secrets, establish persistence, and potentially pivot into the broader network. On a core router or peering edge device, this can translate into network-wide routing integrity and availability loss.

No public exploit exists at the time of writing (POC_STATUS: None; no exploit code; no Nuclei template), so the above is an attack-chain reconstruction based on the vulnerability class, not a validated exploit recipe.

Impact Assessment

• Confidentiality (C:H): Root-level command execution exposes device configuration, cryptographic material, routing tables, and potentially credentials and secrets managed on the platform.
• Integrity (I:H): Attackers can modify routing state and device behavior, undermining routing integrity across the network.
• Availability (A:H): A routing protocol daemon crash or forced relocation of control flow can take the device's routing functions offline, with cascading reachability impact.
• Attack Vector (AV:N): Exploitable over the network; the practical precondition is a configured BGP peering relationship rather than unrestricted internet reach.
• Attack Complexity (AC:L) / Privileges (PR:N) / User Interaction (UI:N): No special conditions beyond the peering precondition, no privileges required, and no victim interaction.
• Scope (S:U): Impacts are confined to the vulnerable routing component as scored.

Business impact and blast radius: Affected systems are Juniper routers and switches running Junos OS or Junos OS Evolved with BGP and BMP route monitoring configured. Because rpd underpins BGP, compromise of this daemon on a border or core routing platform can affect not just the single device but the reachability and integrity of downstream networks. The CVSS score of 9.8 places this at the critical (immediate remediation) tier. CISA KEV status is currently NO, and no exploitation in the wild has been confirmed in the provided data, but the unpatched state (patch confidence 0/4) raises the severity of operational exposure.

Detection Guidance

Sigma Rule

title: Juniper Junos rpd BMP Route Monitoring Stack Buffer Overflow Attempt
id: 9f3c1a74-5b2e-4d8a-9c11-0a7e6d4b3379
status: experimental
description: Detects Junos rpd crashes or abnormal terminations associated with BGP Monitoring Protocol (BMP) route monitoring processing consistent with CVE-2026-33796 (CWE-121 stack buffer overflow).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-33796
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-33796
logsource:
  product: juniper
  service: junos
detection:
  selection_proc:
    process|contains: 'rpd'
  selection_fault:
    message|contains:
      - 'rpd'
    message|contains|any:
      - 'stack smashing'
      - 'buffer overflow'
      - 'signal 11'
      - 'signal 6'
      - 'core dump'
  selection_bmp:
    message|contains: 'BMP'
  condition: selection_proc and selection_fault and selection_bmp
falsepositives:
  - Legitimate rpd restarts unrelated to BMP
  - Administrative daemon restarts during maintenance
level: high

YARA Rule

rule CVE_2026_33796_Junos_rpd_BMP_Overflow
{
    meta:
        description = "Detects BMP route monitoring traffic carrying oversized/overflow-shaped payloads targeting Juniper rpd (CVE-2026-33796, CWE-121)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-33796"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $bmp_hdr = { 03 }              // BMP common header version indicator context
        $bmp_pfx = { 06 00 00 00 }     // BMP route monitoring message type context
        $long_run = /[A-Za-z0-9]{512,}/

    condition:
        filesize > 0 and
        $bmp_pfx and
        any of ($bmp_hdr) and
        #long_run > 0
}

Note: the byte offsets above are illustrative context markers for BMP framing and should be validated against the Junos BMP implementation; no authoritative byte layout is asserted from the provided data.

Suricata IDS Rule

alert tcp any any -> any 179 ( \
  msg:"CVE-2026-33796 Juniper Junos rpd BMP route monitoring oversized payload attempt"; \
  flow:established,to_server; \
  content:"|03|"; offset:0; depth:1; \
  content:"|06 00 00 00|"; within:64; \
  byte_test:4,>,65000,0,relative; \
  threshold:type both, track by_src, count 5, seconds 60; \
  classtype:attempted-admin; \
  reference:cve,2026-33796; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-33796; \
  metadata:service bmp, created_at 2026_01_01, updated_at 2026_01_01; \
  sid:1003379; rev:1;)

Elastic Detection

sequence by host.name with maxspan=30s
  [process where process.name == "rpd" and event.action == "start"]
  [process where process.name == "rpd" and event.category == "process" and
     (message like~ "*stack smashing*" or message like~ "*buffer overflow*" or
      message like~ "*signal 11*" or message like~ "*core dump*")]

Splunk SPL Query

index=network sourcetype=junos:* (process="rpd" OR process_name="rpd")
| search ("BMP" OR "bmp") AND ("buffer overflow" OR "stack smashing" OR "signal 11" OR "signal 6" OR "core dump" OR "SIGSEGV")
| stats count min(_time) as first_seen max(_time) as last_seen values(host) as hosts values(message) as messages by process, host
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="juniper,junos,rpd,">
  <rule id="100337" level="12">
    <decoded_as>json</decoded_as>
    <field name="process">\.*rpd\.*</field>
    <regex type="pcre2">(?i)(buffer overflow|stack smashing|signal 11|signal 6|core dump).*BMP|BMP.*(buffer overflow|stack smashing|signal 11|signal 6|core dump)</regex>
    <description>CVE-2026-33796: Juniper Junos rpd BMP route monitoring stack buffer overflow or crash detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_33796,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list is currently available.

1) Immediate mitigations

• Restrict BGP peering to only trusted, explicitly required external neighbors; audit all configured external BGP neighbors as the description identifies them as the trigger precondition.
• Where operationally feasible, disable BMP route monitoring on devices that do not require it, removing the vulnerable processing path.
• Filter and validate BGP/BMP traffic on the control plane; apply control-plane protection (e.g., firewall filters restricting port 179/tcp and BMP transport to known monitoring infrastructure) to reduce who can reach the service.
• Increase monitoring and logging for rpd crashes, core dumps, and unexpected daemon restarts, and alert on them as potential exploitation attempts.

2) Patch / upgrade steps

• No patch is available as of this writing. Monitor the Juniper Networks security advisories portal for a Junos OS / Junos OS Evolved release that addresses CVE-2026-33796 and apply it as soon as it is published.
• Maintain a current, tested configuration backup and a documented rollback plan so that an emergency upgrade can be applied with minimal disruption once a fixed release ships.

3) Long-term hardening

• Enforce strict BGP peer authentication (e.g., TCP MD5 / MACsec-equivalent protections where supported) and BGP peer-range filtering to reduce the practical reachability of the flaw.
• Adopt a hardened baseline for routing control-plane access, minimizing the number of external BGP peers and monitoring endpoints.
• Track CVE-2026-33796 for confirmed exploitation (CISA KEV status is currently NO) and re-prioritize patching accordingly if exploitation is observed or a PoC is published.
• Given the 9.8 CVSS score and unpatched state, treat affected platforms as high-priority assets pending a fix.

References

• NVD — CVE-2026-33796: https://nvd.nist.gov/vuln/detail/CVE-2026-33796
• CWE-121 (Stack-based Buffer Overflow): https://cwe.mitre.org/data/definitions/121.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• Juniper Networks Security Advisories (vendor advisory portal — monitor for CVE-2026-33796): https://supportportal.juniper.net/s/global-search/%40uri
• CISA Known Exploited Vulnerabilities Catalog (status for CVE-2026-33796: not listed as of this writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or confirmed threat-actor exploitation campaign for CVE-2026-33796 was identified in the provided data.