{"id":"CVE-2026-33796","published":"2026-10-14T17:18:28.320","lastModified":"2026-10-15T16:24:19.073","description":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://supportportal.juniper.net/JSA112187","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A stack-based buffer overflow in Juniper's routing protocol daemon (rpd) allows external BGP neighbors to execute arbitrary commands with root privileges via BMP route monitoring, potentially leading to complete system compromise.","exploitability":"Exploitation requires an attacker to configure an external BGP neighbor and send malicious BMP route updates, making it moderately difficult but possible for network attackers with access to the BGP configuration interface.","blast_radius":"If exploited, this vulnerability could allow attackers to gain full root access to Juniper routers running affected versions of Junos OS or Junos OS Evolved, potentially compromising entire network infrastructures.","remediation":"Apply the latest available patch for Junos OS version 23.4R3 or later, as specified in the vendor advisory.","detection":"Monitor for unusual BMP route update patterns in system logs and check for unexpected process restarts or abnormal memory usage in the rpd daemon.","tags":["rce","bgp","network","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:51:57.837Z"}}