Brief Summary: CVE-2026-33797 BGP Session Reset Vulnerability in Juniper Junos OS and Junos OS Evolved

Introduction

A regression in Juniper's Junos OS 25.2 release train introduced a BGP input validation flaw. An adjacent, unauthenticated attacker can reset an established BGP session with a single genuine packet, then keep the disruption going indefinitely by sending that packet again. For any organization that recently upgraded peering infrastructure to the 25.2 train, this vulnerability (CVE-2026-33797, CVSS v3.1: 7.4) directly threatens routing stability on both eBGP and iBGP adjacencies, over IPv4 and IPv6.

Technical information

Root cause: improper input validation in the BGP processing daemon

CVE-2026-33797 is classified under CWE-20 (Improper Input Validation). The flaw is in the BGP processing daemon of both Junos OS and Junos OS Evolved. When a device running an affected version receives a specific genuine BGP packet from a peer within an already established BGP session, the daemon does not properly validate the packet contents, and that BGP session resets.

The advisory describes the triggering packet as "genuine," meaning it conforms to the BGP protocol specification well enough for the session's TCP connection to accept it and pass it to the BGP state machine. Basic sanity checks and perimeter filters that catch malformed packets would not catch this one. The packet is processed inside an authenticated, established BGP session, so it arrives over an existing TCP port 179 connection that has already completed the BGP OPEN handshake.

The bug is a regression from the 25.2R1 release cycle. Versions before 25.2R1 (and 25.2R1-EVO on the Evolved platform) were never vulnerable. That narrow scope suggests the flaw entered during development of the 25.2 train, likely in a BGP UPDATE or attribute-processing code path that was modified or added in that release.

Attack requirements and flow

Exploitation requires these preconditions:

• The attacker must be on an adjacent network segment (CVSS Attack Vector: Adjacent). In practice, the attacker needs to be a BGP peer or be able to inject traffic into an existing peering link.
• The target device must have an active, established BGP session with the attacker's system (or a system the attacker can influence). Any BGP neighbor relationship configured under [ protocols bgp group <group> neighbor ] is a vulnerable configuration.
• The attacker needs nothing beyond the ability to send BGP packets within the established session: no authentication, no elevated privileges (PR:N), and no user interaction (UI:N).

The attack proceeds in four steps:

1. The attacker establishes a BGP session with the target Junos OS 25.2 device, or uses one that already exists. In many real-world deployments, eBGP sessions with external peers or iBGP sessions with route reflectors would be viable targets.

2. The attacker sends a specific genuine BGP packet within the established session. The exact packet structure has not been publicly disclosed, but it is a valid BGP message that triggers the input validation flaw.

3. The target device's BGP daemon mishandles the packet and immediately resets that BGP session.

4. To sustain the denial of service, the attacker waits for the BGP session to re-establish (which happens automatically in most configurations) and sends the triggering packet again. The repeating cycle of re-establishment and immediate reset causes persistent routing churn and loss of reachability on that adjacency.

Impact characterization

The impact is limited to availability, with no confidentiality or integrity risk. The availability impact is rated High because sustained BGP session resets prevent route convergence and, depending on the affected device's role in the routing topology, can cause cascading reachability problems.

The CVSS v3.1 vector string is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, for a base score of 7.4. Scope is Changed (S:C), meaning the impact extends beyond the vulnerable component itself. That fits, since a BGP session reset affects routing decisions on both sides of the peering relationship and potentially across the broader routing domain.

The CVSS v4.0 score is 7.1 with vector CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L.

Protocol and address family scope

Both iBGP and eBGP sessions are affected, on IPv4 and IPv6 peering alike. The vulnerability is not tied to one address family or BGP deployment model. Any BGP neighbor configuration on an affected version is exposed.

Patch information

Juniper Networks fixed CVE-2026-33797 in software releases published on April 8, 2026, and documented the fix in advisory JSA107850. The fix corrects the input validation logic in the BGP packet processing path, so the specific genuine BGP packet that used to trigger a session reset is now handled properly.

Juniper tracks the internal bug as PR1893316, visible through Juniper's customer support portal at prsearch.juniper.net.

These releases contain the fix:

Juniper has confirmed that this issue has no workarounds. Upgrading to a patched release is the only remediation path. Organizations should immediately inventory their routing infrastructure for devices running the 25.2 or 25.2-EVO releases and schedule upgrades for them.

For vulnerability scanning, Nessus plugin 305584 (juniper_jsa107850.nasl), published on April 8, 2026, can detect vulnerable hosts by checking the self-reported Junos OS version number.

Detection methods

Detecting CVE-2026-33797 takes a combination of vulnerability scanning, configuration auditing, and real-time behavioral monitoring.

Vulnerability scanning with Nessus

Tenable has published Nessus plugin ID 305584 (file: juniper_jsa107850.nasl), released on April 8, 2026, under the "Junos Local Security Checks" family. The plugin runs a version-based check against the device's self-reported Junos OS version and requires the KB item Host/Juniper/JUNOS/Version. It maps directly to Juniper advisory JSA107850 and flags any Junos OS 25.2 installation before 25.2R2 and any Junos OS Evolved 25.2-EVO installation before 25.2R2-EVO. The plugin confirms exposure from the version number but does not detect active exploitation.

Configuration exposure verification

A device is vulnerable only if BGP neighbors are configured under [ protocols bgp group <group> neighbor ]. Administrators can verify exposure by running:

show configuration protocols bgp

Treat every BGP peering configuration on the affected version range as in scope, including eBGP and iBGP sessions over both IPv4 and IPv6.

BGP session state monitoring and log analysis

The most telling behavioral indicator of active exploitation is unexpected, repeated BGP session flapping. Juniper's BGP troubleshooting documentation recommends show bgp summary for finding peer sessions that are not in the Established state or that show elevated flap counters. Watch the "Flaps" column and the "Last Up/Dwn" values in this output. A peer that repeatedly goes down and comes back up in rapid succession warrants investigation.

To capture BGP state transitions in the system log, enable log-updown under [edit protocols bgp]. With it enabled, BGP state transition events go to syslog, which lets operators correlate sudden session drops across multiple peers. Look for BGP sessions moving from Established to Idle or Active with no matching maintenance window or configuration change. As the Juniper BGP troubleshooting guide puts it, "a neighbor state flip-flopping between Connect and Active is an indication that there is a problem."

For deeper packet-level inspection, Juniper's BGP traceoptions facility can log every BGP protocol packet in detail. Under [edit protocols bgp traceoptions], administrators can configure flags such as flag update detail, flag packets, or flag open detail to log sent and received BGP messages to a trace file, then review it with show log <filename>.

Network traffic analysis

Because the attack vector is adjacent network (CVSS AV:A), IDS/IPS sensors and packet capture tools positioned to observe BGP traffic (TCP port 179) between peers can look for anomalous patterns. Inspect captured traffic for unusual BGP UPDATE messages that arrive just before a session reset. No public exploit signature or specific packet pattern has been disclosed for this CVE, but correlating packet captures with the syslog timestamps of BGP resets can help confirm exploitation.

Summary of detection indicators

With no public exploit code or published IDS signatures specific to CVE-2026-33797, detection relies mainly on four methods:

1. Version-based scanning with Nessus plugin 305584.
2. Verifying that the required BGP configuration is present.
3. Monitoring for anomalous BGP session resets through syslog and show bgp summary.
4. Using BGP traceoptions and packet captures for deeper investigation when session instability appears on affected 25.2 releases.

Affected systems and versions

Only the 25.2 release train is affected:

The vulnerable configuration is any BGP neighbor relationship configured under [ protocols bgp group <group> neighbor ], whether the session is eBGP or iBGP and whether it peers over IPv4 or IPv6.

Devices running older release trains (such as 24.x or earlier) are not affected and do not need emergency patching for this specific CVE.

Vendor security history

Juniper Networks' past security incidents bear on how urgently to patch CVE-2026-33797.

In December 2015, an analysis of Juniper ScreenOS firmware revealed unauthorized code that created a backdoor, which let attackers bypass authentication and passively decrypt VPN traffic.

More recently, threat actors heavily targeted two vulnerabilities in the Juniper Junos OS J-Web interface, CVE-2023-36844 and CVE-2023-36845. CISA listed these 2023 vulnerabilities among the top routinely exploited vulnerabilities in its 2023 advisory. The record shows that threat actors actively analyze and exploit Juniper network infrastructure.

On July 2, 2025, Hewlett Packard Enterprise (HPE) acquired Juniper Networks, which became HPE Networking. Organizations that need support for CVE-2026-33797 should make sure their support contracts and portals are mapped to current HPE Networking processes.

As of April 10, 2026, there are no public reports of CVE-2026-33797 being actively exploited in the wild, and the vulnerability is not in the CISA Known Exploited Vulnerabilities catalog. Given the history of exploited Juniper vulnerabilities, remediating now is still the prudent choice.

References

• NVD: CVE-2026-33797
• CVE Record: CVE-2026-33797
• Juniper KB: JSA107850
• Juniper Support Portal: 2026-04 Security Bulletin
• Tenable: CVE-2026-33797
• Tenable Nessus Plugin 305584
• Tenable: CVE-2026-33797 Plugins
• Feedly CVE Tracking: CVE-2026-33797
• Juniper BGP Troubleshooting Documentation
• Juniper KB: BGP PREFIX SID ATTR MALFORMED
• CISA Known Exploited Vulnerabilities Catalog
• CISA: 2023 Top Routinely Exploited Vulnerabilities
• Juniper Networks (Wikipedia)