CVE-2026-33794

Estado: AnalizadaAlta (8.2)—

An Improper Check for Unusual or Exceptional Conditions vulnerability in the

advanced forwarding toolkit (evo-aftmand)

of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated network-based attacker generating continuous routing updates, resulting in unilist ECMP routes, to crash the

evo-aftmand process on the PFE, leading to a Denial-of-Service (DoS). The conditions required for successful exploitation are based on a sequence of events that are outside an attacker's direct control.

Unified list (unilist) ECMP routes are a specific ECMP behavior where multiple equal-cost routes share a single logical next-hop list entry.

Leer descripción completaMostrar menos

The router treats them as one route with multiple next hops and load balances traffic across that unified list. Due to an issue processing unilist ECMP routing updates, internal state corruption may occur, especially in large-scale ECMP unilist deployments, leading to the evo-aftmand process crashing, resulting in an evo-aftmand-bx core. Manual intervention is required to recover by rebooting the system or restarting the FPC.

This issue affects Junos OS Evolved on PTX :

Detalles técnicos trazas, registros y código del informe original

  *  from 24.4R2-EVO before 24.4R2-S3-EVO;
  *  from 25.2 before 25.2R2-EVO.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Green
Puntuación base: 8.2

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.40%
Percentil entre todas las CVEs puntuadas: 33
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access78 %
Impacto principalT1499.004 Application or System Exploitationimpact82 %
Impacto secundarioT1068 Exploitation for Privilege Escalationprivilege escalation45 %

AV:N sin autenticación indica T1190. Ataque de red continuo causa DoS (T1499.004) mediante corrupción de estado en evo-aftmand. Requiere secuencia de eventos fuera del control del atacante, reduciendo confianza. Reinicio necesario implica impacto de disponibilidad del sistema.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network Traffic Application Isolation and Sandboxing Exploit Protection Update Software Vulnerability Scanning Threat Intelligence Program

Tecnologías afectadas (1)

Juniper — Junos OS Evolved

CWE

CWE-754

Referencias

https://supportportal.juniper.net/JSA110073

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-33794",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33794",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-10T14:22:12.408693Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "sirt@juniper.net",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "sirt@juniper.net",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 8.2,
          "Automatable": "YES",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "CONCENTRATED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Green",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "GREEN",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "sirt@juniper.net",
      "affectedData": [
        {
          "vendor": "Juniper Networks",
          "product": "Junos OS Evolved",
          "versions": [
            {
              "status": "affected",
              "version": "24.4R2-EVO",
              "lessThan": "24.4R2-S3-EVO",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "25.2",
              "lessThan": "25.2R2, 25.2R2-EVO",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "PTX Series"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-07-09T21:16:54.790",
  "references": [
    {
      "url": "https://supportportal.juniper.net/JSA110073",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "sirt@juniper.net"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "sirt@juniper.net",
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Improper Check for Unusual or Exceptional Conditions vulnerability in the \n\nadvanced forwarding toolkit (evo-aftmand)\n\n of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated network-based attacker generating continuous routing updates, resulting in unilist ECMP routes, to crash the \n\nevo-aftmand process on the PFE, leading to a Denial-of-Service (DoS). The conditions required for successful exploitation are based on a sequence of events that are outside an attacker's direct control.\n\nUnified list (unilist) ECMP routes are a specific ECMP behavior where multiple equal-cost routes share a single logical next-hop list entry. The router treats them as one route with multiple next hops and load balances traffic across that unified list. Due to an issue processing unilist ECMP routing updates, internal state corruption may occur, especially in large-scale ECMP unilist deployments, leading to the evo-aftmand process crashing, resulting in an evo-aftmand-bx core. Manual intervention is required to recover by rebooting the system or restarting the FPC.\n\nThis issue affects Junos OS Evolved on PTX :\n\n\n  *  from 24.4R2-EVO before 24.4R2-S3-EVO;\n  *  from 25.2 before 25.2R2-EVO."
    }
  ],
  "lastModified": "2026-07-13T12:57:12.750",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.4:r2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "25DA0DD2-E974-448C-BD05-ED6FCA4725FB"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5F6F47F-0C86-4554-8517-A6A0CD29B3B0"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8EDB7A3C-D1F5-4D24-8B8C-F104EC8C7D42"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_os_evolved:25.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DAF96553-DB70-4DFA-8658-306A7477DD06"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_os_evolved:25.2:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83C415EF-E87B-4259-A836-59B3A9C3914B"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_os_evolved:25.2:r1-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AFD32E67-9D8D-437D-96BC-CA97A1F686BA"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos_os_evolved:25.2:r1-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E5D9967-1B53-427B-9B23-77DC399F3D71"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:juniper:ptx1000-72q:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B219F54A-4474-48CB-80F1-D988A719C3DA"
            },
            {
              "criteria": "cpe:2.3:h:juniper:ptx10000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "249F6266-4ED6-4464-9347-9322E1481D0D"
            },
            {
              "criteria": "cpe:2.3:h:juniper:ptx10001:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "6CDCCB33-D428-4D64-977E-71C62F89AE5A"
            },
            {
              "criteria": "cpe:2.3:h:juniper:ptx10001-36mr:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "C188428C-0558-44FB-845C-E885DE9A0733"
            },
            {
              "criteria": "cpe:2.3:h:juniper:ptx100016:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "37F94757-34CE-4F88-A6D3-544FE6A476D5"
            },
            {
              "criteria": "cpe:2.3:h:juniper:ptx10002:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "82B22AC2-B794-4F12-9EB3-9AA6E4B19831"
            },
            {
              "criteria": "cpe:2.3:h:juniper:ptx10002-36qdd:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F805FE65-289B-404D-87A3-289A4A9AC927"
            },
            {
              "criteria": "cpe:2.3:h:juniper:ptx10002-60c:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "1B5462DF-5CF1-4DF9-989B-622EA734964F"
            },
            {
              "criteria": "cpe:2.3:h:juniper:ptx10003:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5BD05415-9F94-4EB8-805A-C9C0FFA9D0DF"
            },
            {
              "criteria": "cpe:2.3:h:juniper:ptx10003_160c:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B1E88A41-B158-4A66-9DFD-438931C6BE68"
            },
            {
              "criteria": "cpe:2.3:h:juniper:ptx10003_80c:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2C97FFB5-8755-474B-ABCF-98DC7659208E"
            },
            {
              "criteria": "cpe:2.3:h:juniper:ptx10003_81cd:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "FAECB1BF-0F3A-4AD9-AF6B-E54A13D9D804"
            },
            {
              "criteria": "cpe:2.3:h:juniper:ptx10004:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "C432E543-37F5-4CA0-B239-2B97C6A16907"
            },
            {
              "criteria": "cpe:2.3:h:juniper:ptx10008:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "65A64A26-4606-4D33-8958-5A3B7FFC4CDB"
            },
            {
              "criteria": "cpe:2.3:h:juniper:ptx10016:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "1879799F-18B2-4958-AA90-FD19348C889F"
            },
            {
              "criteria": "cpe:2.3:h:juniper:ptx12008:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "90D4D075-6304-47C8-8F2C-6F5DB4617DBD"
            },
            {
              "criteria": "cpe:2.3:h:juniper:ptx3000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "516476F9-7D4C-494F-99AA-750F4467CD15"
            },
            {
              "criteria": "cpe:2.3:h:juniper:ptx5000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "654140A0-FEC0-4DB4-83BF-ECCB000DFA4D"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "sirt@juniper.net"
}