CVE-2026-33794
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A vulnerability in the advanced forwarding toolkit (evo-aftmand) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated network-based attacker to generate continuous routing updates, causing the evo-aftmand process on the PFE to crash, leading to a Denial-of-Service (DoS). Successful exploitation depends on a sequence of events outside the attacker's direct control.
Risk Assessment
The risk is that an attacker can trigger a crash of the evo-aftmand process, disrupting routing and packet forwarding services, requiring manual recovery via system or FPC reboot. This can result in significant network downtime and service unavailability.
Recommendation
It is recommended to immediately upgrade Junos OS Evolved to version 24.4R2-S3-EVO or 25.2R2-EVO, which contain the fix. If upgrade is not possible, consider limiting the scope of routing updates or applying temporary filtering rules.
Other vulnerabilities in Junos OS Evolved
See all- CVE-2026-57029Medium
A missing synchronization vulnerability in the sFlow collector handler of Junos OS Evolved on QFX Series allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS). When the reachability of an sFlow collector changes and the sFlow thread simultaneously accesses next-hop data, the evo-pfemand process crashes, blocking traffic forwarding until automatic restart.
- CVE-2026-57028High
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause license exhaustion. Due to incorrect initialization, a process that should only communicate internally can be reached over the network via an open port, leading to unauthorized access to license management.
- CVE-2026-33803Medium
A vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause limited information disclosure and availability impact. Due to incorrect initialization, an internal process is exposed over the network via an open port.
- CVE-2026-33788High
Missing authentication for a critical function in FPCs of Junos OS Evolved on PTX series allows a local authenticated attacker with low privileges to gain direct access to FPCs as a high-privileged user, potentially leading to full compromise.
Original NVD description (English source)
An Improper Check for Unusual or Exceptional Conditions vulnerability in the advanced forwarding toolkit (evo-aftmand) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated network-based attacker generating continuous routing updates, resulting in unilist ECMP routes, to crash the evo-aftmand process on the PFE, leading to a Denial-of-Service (DoS). The conditions required for successful exploitation are based on a sequence of events that are outside an attacker's direct control. Unified list (unilist) ECMP routes are a specific ECMP behavior where multiple equal-cost routes share a single logical next-hop list entry. The router treats them as one route with multiple next hops and load balances traffic across that unified list. Due to an issue processing unilist ECMP routing updates, internal state corruption may occur, especially in large-scale ECMP unilist deployments, leading to the evo-aftmand process crashing, resulting in an evo-aftmand-bx core. Manual intervention is required to recover by rebooting the system or restarting the FPC. This issue affects Junos OS Evolved on PTX : * from 24.4R2-EVO before 24.4R2-S3-EVO; * from 25.2 before 25.2R2-EVO.