Brief Summary: CVE-2026-33785 Missing Authorization in Juniper Junos OS MX Series CLI Enables Full Device Compromise

Introduction

A missing authorization check in Juniper Networks Junos OS on MX Series routers allowed any locally authenticated user to execute privileged management commands that cascade across every device managed by that MX platform. For organizations running MX Series routers in Juniper Device Manager (JDM) or Connected Security Distributed Services (CSDS) scenarios, a single low-privilege CLI session could lead to a complete compromise of the broader managed infrastructure. The flaw carries a CVSS v3.1 score of 8.8, with the scope marked as changed.

Juniper disclosed the vulnerability, tracked as CVE-2026-33785, on April 8, 2026, as part of a batch of 28 security bulletins. Multiple international CERTs, including the Saudi National Cybersecurity Authority, Hong Kong CERT, and Norwegian JustisCERT, have issued high-priority alerts urging immediate patching.

Technical Information

Root Cause: Missing Authorization (CWE-862)

The Junos OS CLI did not enforce authorization requirements on the request csds family of operational commands. These commands interact with the JDM and CSDS management plane and give the operator control over all aspects of the devices managed through the MX Series router. By design, only high-privilege administrators or users explicitly designated for JDM/CSDS operations should be able to invoke them.

However, the CLI accepted these commands from any locally authenticated user session, regardless of the user's assigned privilege level. There was no authorization gate between the command parser and the underlying CSDS functionality.

Impact and Scope

The CVSS v3.1 vector marks the scope as changed (S:C). The vulnerability in the MX router's CLI crosses a security boundary, so exploitation on the MX itself leads to compromise of separate managed devices downstream. Confidentiality, integrity, and availability are all rated High in the impact metrics.

Attack Flow

Based on the advisory details, exploitation follows a straightforward path:

1. Initial Access: An attacker obtains any level of authenticated CLI access to an MX Series router running an affected Junos OS version. This could be a low-privilege operator account, a monitoring account, or any other user with shell or CLI access.

2. Command Execution: The attacker issues request csds CLI operational commands. No privilege escalation exploit or additional tooling is required. The CLI accepts the commands without any authorization check.

3. Management Plane Compromise: Because the request csds commands interact with the JDM/CSDS management plane, the attacker gains the ability to impact all aspects of the devices managed via the respective MX router. The result is a complete compromise of the managed device fleet, with confidentiality, integrity, and availability all affected.

Because of the local access requirement, an attacker cannot exploit this over the network without first obtaining an authenticated session on the device. In environments where multiple operators share access to MX routers with varying privilege levels, though, the barrier to exploitation is minimal.

Patch Information

Juniper Networks addressed CVE-2026-33785 through official firmware updates released on April 8, 2026, as documented in security advisory JSA107872 (internal tracking: PR1914935). The patch enforces authorization so that only users with the appropriate privilege level can run request csds commands.

The fix ships in the following Junos OS releases for MX Series:

All later releases also carry the fix. Junos OS releases before 24.4 are not affected, because the vulnerable request csds functionality was introduced in the 24.4 train. Older branches do not require patching.

Tenable released Nessus plugin 305592 (juniper_jsa107872.nasl) the same day. It detects unpatched devices automatically from each device's self-reported version number.

Detection Methods

Vulnerability Scanner Detection (Tenable Nessus)

Tenable released Nessus Plugin ID 305592 on April 8, 2026, specifically for this vulnerability. The plugin file is named juniper_jsa107872.nasl and belongs to the Junos Local Security Checks family. It is a "combined" type plugin, so it can work with both local and remote data. Detection is version based: the plugin cross-references the self-reported Junos OS version on the device against the known affected version ranges. It needs two KB items populated on the target, Host/Juniper/model and Host/Juniper/JUNOS/Version.

If your organization uses Tenable Nessus or Tenable.io, make sure your plugin feed is updated past the April 8, 2026 release and run authenticated scans against your MX Series fleet.

Version-Based Identification

The Juniper security bulletin (JSA107872) gives exact affected version boundaries for manual or scripted auditing:

• 24.4 releases before 24.4R2-S3
• 25.2 releases before 25.2R2

Junos OS releases before 24.4 are not affected. Network operations teams can check the running Junos version on each MX Series device and compare it against these boundaries to identify exposure. This is especially useful in environments where automated vulnerability scanners cannot reach all network devices.

CLI Command Audit Logging

Because any locally authenticated user can issue request csds CLI operational commands that should be restricted, CLI command auditing is a strong detection angle. Organizations should review their Junos system logs and AAA (authentication, authorization, and accounting) records for any execution of request csds commands by users who are not explicitly authorized for JDM or CSDS operations. Unexpected invocations of these commands, particularly by low-privilege accounts, could indicate attempted or successful exploitation.

What Is Not Available Yet

As of this writing, no public Sigma rules, YARA rules, Snort/Suricata IDS signatures, or published Indicators of Compromise (IoCs) are available for this vulnerability. Because the attack vector is local (requiring authenticated CLI access), network-layer IDS/IPS signatures would not be effective. Detection should focus on endpoint-level version verification and CLI audit log analysis.

Affected Systems and Versions

This vulnerability affects only Juniper Networks Junos OS on MX Series routers, in JDM/CSDS deployment scenarios.

Affected versions:

• Junos OS 24.4 releases before 24.4R2-S3
• Junos OS 25.2 releases before 25.2R2

Not affected:

• Junos OS releases before version 24.4 (the vulnerable request csds functionality was introduced in the 24.4 train)
• Non-MX Series Juniper platforms

Vendor Security History

Juniper Networks, now part of HPE, maintains an active product security incident response process. On April 8, 2026, Juniper published 28 security bulletins in one coordinated batch, covering vulnerabilities across its products. Juniper tracks the advisory for CVE-2026-33785 internally as JSA107872 and PR1914935.

International CERTs responded quickly. Saudi NCA categorized the risk as "very high" for the finance, telecommunications, and government sectors. Given the size of the April 2026 batch and the speed of that response, operators should keep their Juniper infrastructure at current patch levels.

References

• NVD: CVE-2026-33785
• CVE Record: CVE-2026-33785
• Juniper KB: JSA107872
• Juniper Support Portal: 2026-04 Security Bulletin
• Tenable CVE Page: CVE-2026-33785
• Tenable Nessus Plugin 305592
• Saudi National Cybersecurity Authority Alert
• Hong Kong CERT Alert
• Norwegian JustisCERT Advisory
• Feedly CVE Tracking: CVE-2026-33785