CVE-2026-33785
Reported by juniper · Published April 9, 2026
A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on MX Series allows a local, authenticated user with low privileges to execute specific commands which will lead to a complete compromise of managed devices. Any user logged in, without requiring specific privileges, can issue 'request csds' CLI operational commands. These commands are only meant to be executed by high privileged or users designated for Juniper Device Manager (JDM) / Connected Security Distributed Services (CSDS) operations as they will impact all aspects of the devices managed via the respective MX. This issue affects Junos OS on MX Series: * 24.4 releases before 24.4R2-S3, * 25.2 releases before 25.2R2. This issue does not affect Junos OS releases before 24.4.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| Junos OS | Juniper Networks | 25.2R2, 24.4R2-S3, 24.4R1 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Juniper Networks | Junos OS | 24.4, 25.2, 0 |
| Juniper Networks | Junos OS | 24.4, 25.2, 0 |
Timeline
- Apr 8, 2026 CVE Published
- Apr 9, 2026 CVE Updated
- May 18, 2026 EPSS Score (23 in total, the first dated here)
- Jun 2, 2026 Security Advisory
- Jun 24, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-33785
vulnetix vdb fixes CVE-2026-33785Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-33785/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart