Improper Initialization in Junos OS - CVE-2026-33773

Detailed vulnerability description

The vulnerability allows a remote attacker to bypass egress filtering and send traffic that should have been blocked.

The vulnerability exists due to incorrect initialization of resource in the packet forwarding engine (pfe) when applying the same family inet or inet6 egress filter on both an IRB interface and a physical interface. A remote attacker can send network traffic to bypass one of the configured filters and send traffic that should have been blocked.

The issue occurs only when the same filter is configured as an output filter on both an IRB interface and a non-IRB interface.

How to mitigate CVE-2026-33773

Sources

• https://supportportal.juniper.net/s/article/2026-04-Security-Bulletin-Junos-OS-EX-Series-QFX-Series-If-the-same-egress-filter-is-configured-on-both-an-IRB-and-a-physical-interface-one-of-those-is-not-applied-CVE-2026-33773