Juniper Privilege Escalation Vulnerability in Junos OS
Summary
CERT-FR issued a security advisory alerting that Juniper Networks Junos OS and Junos OS Evolved contain a privilege escalation vulnerability (CVE-2026-33793). An attacker with local low-privileged access can exploit unsigned Python op-script configurations to compromise the system. Multiple versions of Junos OS and Junos OS Evolved across branches 22.4 through 25.2 are affected. Patches have been released by Juniper Networks.
What changed
CERT-FR published advisory CERTFR-2026-AVI-0416 disclosing a privilege escalation vulnerability in Juniper Networks Junos OS and Junos OS Evolved products. The flaw, tracked as CVE-2026-33793, allows a local low-privileged user to compromise the system when an unsigned Python op-script configuration is present. The vulnerability affects both standard Junos OS and Junos OS Evolved across numerous version branches from 22.4 through 25.2.
Organizations running affected Juniper Networks equipment must immediately identify vulnerable deployments and apply the corresponding patches released by Juniper Networks. Until patched, the vulnerability poses a significant risk of local privilege escalation, particularly in environments where untrusted users have any local access to network devices. Security teams should review op-script configurations and consider restricting Python op-script functionality as a mitigating control.
What to do next
- Identify all Juniper Junos OS and Junos OS Evolved devices in your infrastructure
- Apply the vendor-provided patches for your specific version (23.2R2-S4, 23.4R2-S6, 24.2R2, 24.4R1-S1, 24.4R2, 25.2R1, and 22.4R3-S7 and later)
- Review configurations for unsigned Python op-scripts and restrict access to privileged operations
Archived snapshot
Apr 10, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Premier Ministre S.G.D.S.N
Agence nationale
de la sécurité des
systèmes d'information
Paris, le 10 avril 2026 N° CERTFR-2026-AVI-0416 Affaire suivie par: CERT-FR
Avis du CERT-FR
Objet: Vulnérabilité dans les produits Juniper Networks
Gestion du document
| Référence | CERTFR-2026-AVI-0416 |
| Titre | Vulnérabilité dans les produits Juniper Networks |
| Date de la première version | 10 avril 2026 |
| Date de la dernière version | 10 avril 2026 |
| Source(s) | Bulletin de sécurité Juniper Networks CVE-2026-33793 du 09 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.
Risque
- Élévation de privilèges
Systèmes affectés
- Junos OS Evolved versions 23.2 antérieures à 23.2R2-S4-EVO
- Junos OS Evolved versions 23.4 antérieures à 23.4R2-S6-EVO
- Junos OS Evolved versions 24.2 antérieures à 24.2R2-EVO
- Junos OS Evolved versions 24.4R1 antérieures à 24.4R1-S1-EVO
- Junos OS Evolved versions 24.4R2 antérieures à 24.4R2-EVO
- Junos OS Evolved versions 25.2 antérieures à 25.2R1-EVO
- Junos OS Evolved versions antérieures à 22.4R3-S7-EVO
- Junos OS versions 23.2R2 antérieures à 23.2R2-S4
- Junos OS versions 23.4R2 antérieures à 23.4R2-S6
- Junos OS versions 24.2R1 antérieures à 24.2R1-S2
- Junos OS versions 24.2R2 antérieures à 24.2R2,
- Junos OS versions 24.4R1 antérieures à 24.4R1-S2 ou 24.4R2
- Junos OS versions 25.2 antérieures à 25.2R1
- Junos OS versions antérieures à 22.4R3-S7
Résumé
Une vulnérabilité a été découverte dans les produits Juniper Networks. Elle permet à un attaquant de provoquer une élévation de privilèges.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Documentation
- Bulletin de sécurité Juniper Networks CVE-2026-33793 du 09 avril 2026
- https://supportportal.juniper.net/s/article/2026-04-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-When-an-unsigned-Python-op-script-configuration-is-present-a-local-low-privileged-user-can-compromise-the-system-CVE-2026-33793
- Référence CVE CVE-2026-33793
- https://www.cve.org/CVERecord?id=CVE-2026-33793
Gestion détaillée du document
- le 10 avril 2026 Version initiale
Named provisions
Related changes
Get daily alerts for CERT-FR Security Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from ANSSI/CERT-FR.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CERT-FR Security Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.