CVE-2026-33794

Full vulnerability record from the local CVENow database.

Description

An Improper Check for Unusual or Exceptional Conditions vulnerability in the advanced forwarding toolkit (evo-aftmand) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated network-based attacker generating continuous routing updates, resulting in unilist ECMP routes, to crash the evo-aftmand process on the PFE, leading to a Denial-of-Service (DoS). The conditions required for successful exploitation are based on a sequence of events that are outside an attacker's direct control. Unified list (unilist) ECMP routes are a specific ECMP behavior where multiple equal-cost routes share a single logical next-hop list entry. The router treats them as one route with multiple next hops and load balances traffic across that unified list. Due to an issue processing unilist ECMP routing updates, internal state corruption may occur, especially in large-scale ECMP unilist deployments, leading to the evo-aftmand process crashing, resulting in an evo-aftmand-bx core. Manual intervention is required to recover by rebooting the system or restarting the FPC. This issue affects Junos OS Evolved on PTX : * from 24.4R2-EVO before 24.4R2-S3-EVO; * from 25.2 before 25.2R2-EVO.

Severity

HIGH

CVSS score

8.2 (v4.0)

Vulnerability status

Analyzed

Source identifier

[email protected]

Published

2026-07-09 21:16:54.790000

Last modified

2026-10-25 17:10:00.197000

View original CVE JSON

{
  "id": "CVE-2026-33794",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-09T21:16:54.790",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Improper Check for Unusual or Exceptional Conditions vulnerability in the \n\nadvanced forwarding toolkit (evo-aftmand)\n\n of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated network-based attacker generating continuous routing updates, resulting in unilist ECMP routes, to crash the \n\nevo-aftmand process on the PFE, leading to a Denial-of-Service (DoS). The conditions required for successful exploitation are based on a sequence of events that are outside an attacker's direct control.\n\nUnified list (unilist) ECMP routes are a specific ECMP behavior where multiple equal-cost routes share a single logical next-hop list entry. The router treats them as one route with multiple next hops and load balances traffic across that unified list. Due to an issue processing unilist ECMP routing updates, internal state corruption may occur, especially in large-scale ECMP unilist deployments, leading to the evo-aftmand process crashing, resulting in an evo-aftmand-bx core. Manual intervention is required to recover by rebooting the system or restarting the FPC.\n\nThis issue affects Junos OS Evolved on PTX :\n\n\n  *  from 24.4R2-EVO before 24.4R2-S3-EVO;\n  *  from 25.2 before 25.2R2-EVO."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de comprobación incorrecta de condiciones inusuales o excepcionales en el kit de herramientas de reenvío avanzado (evo-aftmand) de Juniper Networks Junos OS Evolved en la serie PTX permite a un atacante no autenticado basado en red que genera actualizaciones de enrutamiento continuas, lo que resulta en rutas ECMP de lista unificada, bloquear el proceso evo-aftmand en el PFE, lo que lleva a una denegación de servicio (DoS). Las condiciones necesarias para una explotación exitosa se basan en una secuencia de eventos que están fuera del control directo de un atacante.\n\nLas rutas ECMP de lista unificada (unilist) son un comportamiento ECMP específico donde múltiples rutas de igual coste comparten una única entrada lógica de lista de siguiente salto. El router las trata como una ruta con múltiples siguientes saltos y equilibra la carga del tráfico a través de esa lista unificada. Debido a un problema al procesar las actualizaciones de enrutamiento ECMP de lista unificada, puede producirse una corrupción del estado interno, especialmente en implementaciones ECMP de lista unificada a gran escala, lo que lleva al bloqueo del proceso evo-aftmand, resultando en un core evo-aftmand-bx. Se requiere intervención manual para recuperarse reiniciando el sistema o el FPC.\n\nEste problema afecta a Junos OS Evolved en PTX:\n\n*   desde 24.4R2-EVO anterior a 24.4R2-S3-EVO;\n*   desde 25.2 anterior a 25.2R2-EVO."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Juniper Networks",
          "product": "Junos OS Evolved",
          "defaultStatus": "unaffected",
          "platforms": [
            "PTX Series"
          ],
          "versions": [
            {
              "version": "24.4R2-EVO",
              "lessThan": "24.4R2-S3-EVO",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "25.2",
              "lessThan": "25.2R2, 25.2R2-EVO",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Green",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "LOW",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "YES",
          "Recovery": "USER",
          "valueDensity": "CONCENTRATED",
          "vulnerabilityResponseEffort": "MODERATE",
          "providerUrgency": "GREEN"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-10T14:22:12.408693Z",
          "id": "CVE-2026-33794",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.4:r2:*:*:*:*:*:*",
              "matchCriteriaId": "25DA0DD2-E974-448C-BD05-ED6FCA4725FB"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s1:*:*:*:*:*:*",
              "matchCriteriaId": "C5F6F47F-0C86-4554-8517-A6A0CD29B3B0"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s2:*:*:*:*:*:*",
              "matchCriteriaId": "8EDB7A3C-D1F5-4D24-8B8C-F104EC8C7D42"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos_os_evolved:25.2:-:*:*:*:*:*:*",
              "matchCriteriaId": "DAF96553-DB70-4DFA-8658-306A7477DD06"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos_os_evolved:25.2:r1:*:*:*:*:*:*",
              "matchCriteriaId": "83C415EF-E87B-4259-A836-59B3A9C3914B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos_os_evolved:25.2:r1-s1:*:*:*:*:*:*",
              "matchCriteriaId": "AFD32E67-9D8D-437D-96BC-CA97A1F686BA"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:juniper:junos_os_evolved:25.2:r1-s2:*:*:*:*:*:*",
              "matchCriteriaId": "0E5D9967-1B53-427B-9B23-77DC399F3D71"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:juniper:ptx1000-72q:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B219F54A-4474-48CB-80F1-D988A719C3DA"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:juniper:ptx10000:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "249F6266-4ED6-4464-9347-9322E1481D0D"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:juniper:ptx10001:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6CDCCB33-D428-4D64-977E-71C62F89AE5A"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:juniper:ptx10001-36mr:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C188428C-0558-44FB-845C-E885DE9A0733"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:juniper:ptx100016:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "37F94757-34CE-4F88-A6D3-544FE6A476D5"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:juniper:ptx10002:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "82B22AC2-B794-4F12-9EB3-9AA6E4B19831"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:juniper:ptx10002-36qdd:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F805FE65-289B-404D-87A3-289A4A9AC927"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:juniper:ptx10002-60c:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1B5462DF-5CF1-4DF9-989B-622EA734964F"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:juniper:ptx10003:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5BD05415-9F94-4EB8-805A-C9C0FFA9D0DF"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:juniper:ptx10003_160c:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B1E88A41-B158-4A66-9DFD-438931C6BE68"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:juniper:ptx10003_80c:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2C97FFB5-8755-474B-ABCF-98DC7659208E"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:juniper:ptx10003_81cd:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FAECB1BF-0F3A-4AD9-AF6B-E54A13D9D804"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:juniper:ptx10004:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C432E543-37F5-4CA0-B239-2B97C6A16907"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:juniper:ptx10008:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "65A64A26-4606-4D33-8958-5A3B7FFC4CDB"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:juniper:ptx10016:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1879799F-18B2-4958-AA90-FD19348C889F"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:juniper:ptx12008:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "90D4D075-6304-47C8-8F2C-6F5DB4617DBD"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:juniper:ptx3000:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "516476F9-7D4C-494F-99AA-750F4467CD15"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:juniper:ptx5000:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "654140A0-FEC0-4DB4-83BF-ECCB000DFA4D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://supportportal.juniper.net/JSA110073",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}