CVE-2026-33773
Reported by juniper · Published April 9, 2026
An Incorrect Initialization of Resource vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series and QFX Series device allows an unauthenticated, network-based attacker to cause an integrity impact to downstream networks. When the same family inet or inet6 filter is applied on an IRB interface and on a physical interface as egress filter on EX4100, EX4400, EX4650 and QFX5120 devices, only one of the two filters will be applied, which can lead to traffic being sent out one of these interfaces which should have been blocked. This issue affects Junos OS on EX Series and QFX Series: * 23.4 version 23.4R2-S6, * 24.2 version 24.2R2-S3. No other Junos OS versions are affected.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| Junos OS | Juniper Networks | 24.2R2-S4, 23.4R2-S7 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Juniper Networks | Junos OS | 23.4R2-S6, 24.2R2-S3 |
| Juniper Networks | Junos OS | 23.4R2-S6, 24.2R2-S3 |
Timeline
- Apr 8, 2026 CVE Published
- Apr 9, 2026 CVE Updated
- Apr 9, 2026 PoC Published
- May 18, 2026 EPSS Score (30 in total, the first dated here)
- Jun 2, 2026 Security Advisory
- Jun 24, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-33773
vulnetix vdb fixes CVE-2026-33773Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-33773/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart