CVE-2026-33773: Junos OS: EX Series, QFX Series: If the same egress filter is configured on both an IRB and a physical interface one of those is not applied

Published Apr 9, 2026

Updated

An Incorrect Initialization of Resource vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series and QFX Series device allows an unauthenticated, network-based attacker to cause an integrity impact to downstream networks.

When the same family inet or inet6 filter is applied on an IRB interface and on a physical interface as egress filter on EX4100, EX4400, EX4650 and QFX5120 devices, only one of the two filters will be applied, which can lead to traffic being sent out one of these interfaces which should have been blocked.

This issue affects Junos OS on EX Series and QFX Series: 23.4 version 23.4R2-S6, 24.2 version 24.2R2-S3.

No other Junos OS versions are affected.

Affected Software

29 affected components

Juniper Networks Junos OS (EX Series, QFX Series)=23.4R2-S6, =24.2R2-S3

All of the following

Any of the following

Juniper Junos=23.4-r2-s6

Juniper Junos=24.2-r2-s3

Any of the following

Juniper EX2300

Juniper EX2300-C

Juniper EX3400

Juniper EX4000

Juniper EX4100

Juniper Ex4100-f

Juniper Ex4100-h

Juniper EX4300

Juniper EX4400

Juniper EX4600

Juniper EX4650

Juniper Ex9204

Juniper Ex9208

Juniper Ex9214

Juniper QFX10008

Juniper QFX10016

Juniper QFX5110

Juniper QFX5120

Juniper Qfx5130

Juniper QFX5200

Juniper QFX5210

Juniper QFX5220

Juniper Qfx5230-64cd

Juniper Qfx5240

Juniper Qfx5241

Juniper Qfx5700

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Juniper Networks Junos OS (EX Series/QFX Series) to a version that resolves this vulnerability.
Fixed in 23.4R2-S7
Upgrade
Upgrade Juniper Networks Junos OS (EX Series/QFX Series) to a version that resolves this vulnerability.
Fixed in 24.2R2-S4

Event History

Apr 9, 2026

CVE Published

via MITRE·09:28 PM

Data Sourced

via MITRE·09:28 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-33773?

CVE-2026-33773 has been rated as a high severity vulnerability due to its impact on packet filtering.

How do I fix CVE-2026-33773?

To fix CVE-2026-33773, apply the recommended patches or upgrade to the latest secure versions of Junos OS, specifically beyond 23.4R2-S6 and 24.2R2-S3.

What systems are affected by CVE-2026-33773?

CVE-2026-33773 affects specific EX Series and QFX Series devices running Junos OS versions 23.4R2-S6 and 24.2R2-S3.

Is there a workaround for CVE-2026-33773?

Currently, no specific workaround has been documented for CVE-2026-33773; the best approach is to apply the security updates.

What type of vulnerability is CVE-2026-33773?

CVE-2026-33773 is classified as an Incorrect Initialization of Resource vulnerability in the Junos OS packet forwarding engine.