Juniper SRX Users Urged to Patch CVE-2026-33792 srxpfe Stack Buffer Overflow Vulnerability

Juniper Networks has identified a critical security flaw in its SRX Series firewalls. The vulnerability, tracked as CVE-2026-33792, exists in the srxpfe process of Junos OS. According to the National Vulnerability Database, this issue allows an unauthenticated network attacker to execute arbitrary code with root privileges or cause a denial of service. The attack vector involves sending a specifically crafted packet to a configured GRE tunnel on the affected device.

In plain English

The flaw is a stack-based buffer overflow within the srxpfe component. This means the software does not properly handle certain data inputs. When a malicious packet arrives through a Generic Routing Encapsulation tunnel, the system crashes or runs attacker-controlled commands. The attacker needs no login credentials to exploit this weakness. The impact is severe because the resulting code execution happens at the highest administrative level, known as root access.

The background

The issue affects multiple release trains of Juniper Networks Junos OS. According to NVD records, versions prior to 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, and 24.4R2-S5 are vulnerable. The vulnerability is classified as critical with a CVSS score of 9.8 or 9.3 depending on the specific vector configuration. The underlying weakness is identified as CWE-121, which refers to a classic stack-based buffer overflow error. This type of bug often results from insufficient bounds checking in code.

What changes now

Administrators must verify if their SRX Series devices run the affected versions. No fix has been confirmed yet in the source material, so organizations should monitor vendor announcements. If a device runs a version earlier than the specified service releases, it is at risk. The vulnerability is present in the srxpfe process. Users should check their current Junos OS version against the affected list provided by the National Vulnerability Database.

Who needs to act first

Teams usually prioritize systems exposed directly to the internet or untrusted networks. Check whether your SRX devices host active GRE tunnels facing external traffic. Prepare to update these high-exposure devices first once a fix is available, after testing in a non-production environment. Always back up configurations before applying major software updates. If immediate patching is not feasible, monitor logs for unusual activity on tunnel interfaces. Coordinate changes during maintenance windows to avoid service disruption.

Background: Software updates

Software updates use delta compression to minimize data transfer, verify integrity via digital signatures, and employ transactional installs to ensure the system remains bootable even if the process fails midway.

Read the full guide: How Software Updates Work: The Hidden Verification Steps

What to do and how to stay safe: Juniper Networks

• Inventory all SRX Series devices and check their current Junos OS versions against the affected list.
• Identify which devices have active GRE tunnels configured, especially those facing untrusted networks.
• Monitor vendor announcements for the release of patches for the affected versions.
• Monitor network logs for anomalous packet patterns on tunnel interfaces while waiting for updates.

Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality

General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-33792?

The National Vulnerability Database lists the base score as 9.8 CRITICAL for one vector and 9.3 CRITICAL for another.

Which Junos OS versions are affected?

Versions before 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, and 24.4R2-S5 are affected by this vulnerability.

Can this flaw be exploited remotely?

Yes, an unauthenticated network attacker can exploit it by sending a crafted packet to a configured GRE tunnel.