Juniper SRX CVE-2026-33792: Critical Buffer Overflow in srxpfe Grants Root Access via GRE Packets
A critical buffer overflow in Juniper SRX firewalls allows attackers to run code as root via crafted GRE packets, affecting multiple Junos OS release branches.
Key points
- CVE-2026-33792 is rated CVSS 9.8 CRITICAL by the NVD.
- The flaw exists in the srxpfe process on SRX Series devices.
- Affected versions include Junos OS prior to 23.2R2-S7.7 and other specified branches.
Juniper Networks SRX Series firewalls running specific versions of Junos OS contain a critical vulnerability in the srxpfe process. This stack-based buffer overflow allows unauthenticated network attackers to execute arbitrary code with root privileges or cause denial of service. The flaw is triggered by crafted packets received on configured GRE tunnels, exposing organisations that rely on these devices for perimeter security.
Root cause
The vulnerability is a stack-based buffer overflow within the srxpfe process. According to the National Vulnerability Database, this weakness corresponds to CWE-121. The source material describes the flaw as allowing code execution or denial of service via a crafted packet received on a configured GRE tunnel, without detailing specific validation failures.
Attack path
An attacker requires no authentication to exploit this issue. By sending a specifically crafted packet to a configured GRE tunnel on an affected SRX device, the attacker can trigger the overflow. This action permits the execution of code as the root user or results in a denial of service, effectively compromising the device’s integrity and availability.
Affected versions
The National Vulnerability Database lists the following Junos OS versions as affected:
- Versions before 23.2R2-S7.7
- Versions before 23.4R2-S8.13
- Versions before 24.2R2-S5.5
- Versions before 24.4R2-S5
Mitigation
- Update devices to the latest supported Junos OS versions listed above.
- Disable unused GRE tunnels if immediate updates are not possible.
- Implement strict access controls to limit exposure of tunnel endpoints.
- Monitor logs for unusual traffic patterns on GRE interfaces.
What it means for organisations
Security teams should immediately verify the Junos OS versions across all SRX deployments. Infrastructure leads must assess whether GRE tunnels are active and exposed to untrusted networks. Risk managers need to evaluate the potential impact of root-level compromise on data integrity and service continuity. Communication should flow to network operations and incident response teams to prepare for potential exploitation.
What to do and how to stay safe: Juniper Networks
- Audit all SRX Series devices to identify affected Junos OS versions.
- Check configuration files for enabled GRE tunnels and their exposure.
- Apply vendor-provided updates as soon as they become available.
- Review firewall logs for signs of abnormal packet sizes or patterns.
General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-33792?
The National Vulnerability Database rates it as 9.8 CRITICAL.
Which process is affected in Junos OS?
The srxpfe process on SRX Series devices is affected.
Is authentication required to exploit this flaw?
No, the vulnerability allows unauthenticated network attackers to execute code.
