Command injection in Junos OS Evolved and Junos OS - CVE-2026-33791

Vulnerability details

The vulnerability allows a local privileged user to execute arbitrary shell commands as root.

The vulnerability exists due to command injection in the CLI processing of certain 'set system' commands when handling crafted CLI arguments. A local privileged user can execute specific crafted CLI commands to execute arbitrary shell commands as root.

The injected shell commands are executed with root privileges, which can result in complete compromise of the system.

Affected software

How to mitigate CVE-2026-33791

External References

• https://supportportal.juniper.net/s/article/2026-04-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Execution-of-crafted-CLI-commands-allows-for-arbitrary-shell-injection-as-root-CVE-2026-33791
• https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Related Security Bulletins

• Privilege escalation in Junos OS and Junos OS Evolved CLI