CVE-2026-33783

Junos OS Evolved: PTX Series: If SRTE tunnels provisioned via PCEP are present and specific gRPC queries are received evo-aftmand crashes

MEDIUM

6.5

CVSS Score

Published: April 9, 2026 at 09:36 PM UTC

Updated: June 17, 2026 at 10:38 AM UTC

2 products affected across 2 vendorsJunos OS EvolvedJunos OS Evolved

Using Junos OS Evolved by Juniper Networks?

Get instant alerts when new vulnerabilities affect Junos OS Evolved - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.5

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

A Function Call With Incorrect Argument Type vulnerability in the sensor interface of Juniper Networks Junos OS Evolved on PTX Series allows a network-based, authenticated attacker with low privileges to cause a complete Denial of Service (DoS). If colored SRTE policy tunnels are provisioned via PCEP, and gRPC is used to monitor traffic in these tunnels, evo-aftmand crashes and doesn't restart which leads to a complete and persistent service impact. The system has to be manually restarted to recover. The issue is seen only when the Originator ASN field in PCEP contains a value larger than 65,535 (32-bit ASN). The issue is not reproducible when SRTE policy tunnels are statically configured. This issue affects Junos OS Evolved on PTX Series: * all versions before 22.4R3-S9-EVO, * 23.2 versions before 23.2R2-S6-EVO, * 23.4 versions before 23.4R2-S7-EVO, * 24.2 versions before 24.2R2-S4-EVO, * 24.4 versions before 24.4R2-S2-EVO, * 25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Junos OS Evolved · Juniper

95%

juniper-ptx10001-36mr (environment) · juniper-ptx10002-36qdd (environment) · juniper-ptx10003 (environment) · juniper-ptx10004 (environment) · juniper-ptx10008 (environment) · juniper-ptx10016 (environment) · juniper-ptx12008 (environment)

Junos OS Evolved · Juniper Networks

60%

v < 22.4R3-S9-EVO23.2 ≤ v < 23.2R2-S6-EVO23.4 ≤ v < 23.4R2-S7-EVO24.2 ≤ v < 24.2R2-S4-EVO24.4 ≤ v < 24.4R2-S2-EVO25.2 ≤ v < 25.2R1-S2-EVO, 25.2R2-EVO23.2 23.4 24.2 24.4 25.2

Affected range stops below 22.4R3-S9-EVO, so it looks safe — our inference, not a vendor statement

Affected range stops below 23.2R2-S6-EVO, so it looks safe — our inference, not a vendor statement

Affected range stops below 23.4R2-S7-EVO, so it looks safe — our inference, not a vendor statement

Affected range stops below 24.2R2-S4-EVO, so it looks safe — our inference, not a vendor statement

Affected range stops below 24.4R2-S2-EVO, so it looks safe — our inference, not a vendor statement

Affected range stops below 25.2R1-S2-EVO, 25.2R2-EVO, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://kb.juniper.net/JSA107870

References (1)

Vendor AdvisoryMitigation

Source: cverecord

https://kb.juniper.net/JSA107870

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.5MEDIUMjuniper

Attack Vector: NETWORK
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: NONE
Integrity: NONE
Availability: HIGH

Vector?

Quick Info

StatusANALYZED

CWE

CWE-686

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card