Juniper SRX Series CVE-2026-33790: NAT64 ICMPv6 Denial of Service via srxpfe Crash

Introduction

A malformed ICMPv6 packet sent to a Juniper SRX Series firewall performing NAT64 translation can crash the packet forwarding engine, and an attacker who keeps sending that packet can hold the device in a sustained outage. CVE-2026-33790 carries a CVSS v3.1 score of 7.5 and a CVSS v4.0 score of 8.7. Those scores reflect a remotely exploitable, unauthenticated denial-of-service condition in a widely deployed class of network security appliance.

Juniper's SRX Series firewalls are a staple of enterprise and service provider networks, where they sit at the perimeter in data centers, campus environments, and large branch offices. Juniper Networks is now part of HPE, and the SRX installed base is substantial. Any vulnerability that can take an SRX offline with a single packet deserves close attention from network and security operations teams.

Technical information

Root cause

CVE-2026-33790 is classified under CWE-754: Improper Check for Unusual or Exceptional Conditions. The flaw is in the Junos OS flow daemon (flowd), in how the srxpfe process (the SRX Packet Forwarding Engine) handles ICMPv6 packets during NAT64 translation. When a specific malformed ICMPv6 packet destined to the device itself arrives and enters the NAT64 translation path, srxpfe hits an unhandled exceptional condition and crashes.

The underlying problem is a missing validation step. The code that processes ICMPv6 packets in the NAT64 translation flow does not adequately bounds-check or validate certain malformed packet structures. When the malformed packet reaches that unprotected code path, it triggers a fatal error, and srxpfe crashes and restarts.

CVSS metrics

Exploit preconditions

The vulnerability has a narrow scope, but the impact on exposed configurations is high. An attack needs three conditions:

1. The target must be a Juniper SRX Series device running a vulnerable version of Junos OS.
2. The device must have an active NAT64 (IPv6 to IPv4 translation) configuration.
3. The attacker must be able to route a malformed ICMPv6 packet to the device.

SRX devices that are not actively performing NAT64 translation are not exposed to this attack, whatever Junos OS version they run. IPv4 traffic and other standard IPv6 traffic cannot trigger the issue.

Attack flow

Based on the advisory details, exploitation proceeds as follows:

1. The attacker identifies a target SRX Series device with NAT64 enabled and IPv6 reachability.
2. The attacker crafts a specific malformed ICMPv6 packet and sends it to the device. The packet must be destined to the device itself (not simply transiting it) and must enter the NAT64 translation path.
3. When flowd processes this packet through the NAT64 translation logic, the srxpfe process hits the unhandled condition and crashes.
4. The srxpfe process restarts automatically, but the attacker can immediately send another malformed packet.
5. By sending these packets continuously, the attacker keeps srxpfe in a crash loop. The denial of service persists, and all traffic processing on the device is disrupted.

The attack needs no authentication or user interaction, and its complexity is low. The only requirement is network reachability to the target device over IPv6.

Patch information

Juniper Networks published security advisory JSA107874 on April 8, 2026, with official firmware-level patches for multiple supported Junos OS release trains on the SRX Series. The fix adds validation and bounds checking for malformed ICMPv6 packets before they reach the crash-inducing code path. On a patched device, srxpfe rejects malformed ICMPv6 packets instead of crashing and restarting.

These Junos OS releases contain the fix:

No fix for end-of-life branches. The 21.3 and 22.1 release branches have no patch, and every version in those trains remains vulnerable. Both branches have reached Juniper's End of Engineering (EOE) or End of Life (EOL) status, and Juniper's SIRT policy does not backport fixes to them. Organizations still running 21.3 or 22.1 on SRX Series devices must upgrade to a supported train with the fix applied.

The advisory lists versions "from 22.2 before 22.2R3-S8" as affected, which implies a fix boundary at 22.2R3-S8 for the 22.2 branch. That version is absent from the official Solution list, though, which suggests 22.2 may also be near or at EOL.

Juniper tracks the fix internally as bug PR1897060. The advisory confirms there are no workarounds, so upgrading to patched firmware is the only remediation path. Only SRX Series devices configured with NAT64 are affected, so the fix is specifically relevant to environments where that configuration is active.

Detection methods

Detecting CVE-2026-33790 means combining vulnerability scanning with behavioral monitoring on Juniper SRX Series devices.

Vulnerability scanning with Nessus

Tenable released a dedicated Nessus plugin, Plugin ID 305588 (file: juniper_jsa107874.nasl), on April 8, 2026, in the "Junos Local Security Checks" family. The plugin runs a version-based check against the device's self-reported Junos OS version, using the Host/Juniper/model and Host/Juniper/JUNOS/Version knowledge base items collected during credentialed scans. It does not try to exploit the vulnerability. It compares the running Junos OS version against the list of known affected releases and flags at-risk devices. Organizations running Nessus or Tenable products should make sure their scan policies for SRX infrastructure include this plugin.

Version-based identification

Defenders without automated scanning can audit their SRX fleet for exposure by hand. The Juniper advisory (JSA107874) lists the affected Junos OS versions precisely, and the show version command on Junos OS displays the current release. Any SRX device running a version in the affected ranges needs immediate investigation.

Configuration exposure check

The vulnerability requires a NAT64 configuration on the SRX device. The Juniper advisory gives example configuration stanzas for this, including NAT source pools with IPv4 addresses, rule sets matching IPv6 source addresses with a 0.0.0.0/0 destination, and static NAT rule sets using static-nat inet under a destination IPv6 /96 prefix. Defenders should audit their SRX configurations and identify every device with active NAT64 rule sets, because those are the only devices exposed to this attack. Devices without NAT64 configurations are not vulnerable on any Junos OS version.

Behavioral monitoring for active exploitation

This vulnerability makes srxpfe crash and restart when it receives a malformed ICMPv6 packet during NAT64 translation. Repeated or unexpected srxpfe crashes are therefore the main behavioral sign that exploitation may be underway. Security operations teams should watch device logs and SNMP traps for recurring srxpfe restarts on SRX devices with NAT64 enabled. Treat a pattern of repeated crashes, particularly alongside elevated ICMPv6 traffic, as a strong sign of attack attempts and investigate it promptly.

Gaps in detection coverage

At the time of writing, no IDS/IPS signatures (such as Snort or Suricata rules), YARA rules, or Sigma detection rules have been published specifically for CVE-2026-33790. There are also no known traditional indicators of compromise, such as file hashes or malicious IP addresses. That fits a network-based DoS vulnerability with no malware involved. Detection therefore relies mainly on version auditing, configuration review, and process crash monitoring rather than signature-based network detection.

Affected systems and versions

The vulnerability affects Juniper Networks Junos OS on the SRX Series platform only. These version ranges are affected:

Required configuration: Only SRX Series devices with an active NAT64 (IPv6 to IPv4 translation) configuration are vulnerable. Devices without NAT64 configured are not affected, whatever their Junos OS version.

Vendor security history

Threat actors have a history of targeting the SRX Series platform. A joint advisory from CISA and partner agencies (advisory AA24-317A) listed multiple Juniper SRX vulnerabilities among the top routinely exploited vulnerabilities of 2023. Flaws such as CVE-2023-36844, which affects Junos OS on SRX Series, were heavily targeted in the wild. Juniper edge-device vulnerabilities have been weaponized quickly in the past, and attackers have shown both the capability and the intent to exploit SRX flaws soon after disclosure. No exploitation of CVE-2026-33790 has been confirmed today, but that record argues for treating this advisory as urgent.

References

• NVD: CVE-2026-33790
• CVE Record: CVE-2026-33790
• MITRE CVE Entry: CVE-2026-33790
• Juniper KB: JSA107874
• Juniper Support Portal: 2026-04 Security Bulletin for SRX Series
• Tenable CVE Page: CVE-2026-33790
• Tenable Nessus Plugin 305588
• Tenable Nessus Plugin 305588 Dependencies
• Tenable Nessus Plugin 305588 Dependents
• Feedly CVE Tracking: CVE-2026-33790
• CISA Advisory AA24-317A: 2023 Top Routinely Exploited Vulnerabilities
• DoD/NSA: 2023 Top Routinely Exploited Vulnerabilities (PDF)
• HK GovCERT Security Alert (A26-04-11)
• CSIRT Senegal Advisory: Juniper Networks Vulnerabilities (April 2026)