SB2026050829 - Egress filters bypass in Junos OS

Security Bulletin ID SB2026050829

CSH Severity

Medium

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Initialization (CVE-ID: CVE-2026-33773)

The vulnerability allows a remote attacker to bypass egress filtering and send traffic that should have been blocked.

The vulnerability exists due to incorrect initialization of resource in the packet forwarding engine (pfe) when applying the same family inet or inet6 egress filter on both an IRB interface and a physical interface. A remote attacker can send network traffic to bypass one of the configured filters and send traffic that should have been blocked.

The issue occurs only when the same filter is configured as an output filter on both an IRB interface and a non-IRB interface.

Remediation

Install update from vendor's website.

References

https://supportportal.juniper.net/s/article/2026-04-Security-Bulletin-Junos-OS-EX-Series-QFX-Series-If-the-same-egress-filter-is-configured-on-both-an-IRB-and-a-physical-interface-one-of-those-is-not-applied-CVE-2026-33773