CVE-2026-33799

Junos OS and Junos OS Evolved: Receipt of a specific SNMPv3 request results in memory leak and eventual snmpd crash

5.3MediumCVSS base score
0.37%Exploitation in 30 daysEPSS · top 69% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

An Out-of-bounds Write vulnerability in the SNMP daemon (snmpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker sending specific valid SNMPv3 queries to trigger a memory leak. Over time, continuous receipt of these queries will result in snmpd process memory exhaustion, resulting in a process crash and restart, impacting the ability to monitor the system via SNMP. Memory usage can be monitored using the following command: user@device> show system processes extensive | match snmpd This issue affects: Junos OS: * all versions before 21.2R3-S8; * from 21.4 before 21.4R3-S7; * from 22.1 before 22.1R3-S6; * from 22.2 before 22.2R3-S4; * from 22.3 before 22.3R3-S3; * from 22.4 before 22.4R3-S2; * from 23.2 before 23.2R2; * from 23.4 before 23.4R2. Junos OS Evolved: * all versions before 21.2R3-S8-EVO; * from 21.4 before 21.4R3-S7-EVO; * all versions of 22.1-EVO, * from 22.2 before 22.2R3-S4-EVO; * from 22.3 before 22.3R3-S3-EVO; * all versions of 22.4-EVO, * from 23.2 before 23.2R2-EVO; * from 23.4 before 23.4R2-EVO.

Timeline

2026
23 Mar 2026
23 Mar 2026
ID reserved
By juniper
9 Jul 20264 months later
9 Jul 2026· 4 months later
Published
10 Jul 20261 day later
10 Jul 2026· 1 day later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-33799, by who scored it
Scored by	CVSS	Score	Vector
juniperCNA (assigner)	4.0	Medium5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/AU:Y/R:A/V:C/RE:M/U:Green
juniperCNA (assigner)	3.1	Medium4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
NVDNVD · Analyzed	4.0	Medium5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:Green

EPSS (exploitation in 30 days): 0.37% · top 69% of all CVEs (11 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Affected products

Juniper Networks · Junos OS
- affected < 21.2R3-S8
- affected 21.4 – < 21.4R3-S7
- affected 22.1 – < 22.1R3-S6
- affected 22.2 – < 22.2R3-S4
- affected 22.3 – < 22.3R3-S3
- affected 22.4 – < 22.4R3-S2
- affected 23.2 – < 23.2R2
- affected 23.4 – < 23.4R2
Juniper Networks · Junos OS Evolved
- affected < 21.2R3-S8-EVO
- affected 21.4 – < 21.4R3-S7-EVO
- affected 22.1 – < 22.1*
- affected 22.2 – < 22.2R3-S4-EVO
- affected 22.3 – < 22.3R3-S3-EVO
- affected 22.4 – < 22.4*
- affected 23.2 – < 23.2R2-EVO
- affected 23.4 – < 23.4R2-EVO

What to do

Solution: The following software releases have been updated to resolve this specific issue: Junos OS: 21.2R3-S8, 21.4R3-S7, 22.1R3-S6, 22.2R3-S4, 22.3R3-S3, 22.4R3-S2, 23.2R2, 23.4R2, 24.2R1, and all subsequent releases. Junos OS Evolved: 21.2R3-S8-EVO, 21.4R3-S7-EVO, 22.2R3-S4-EVO, 22.3R3-S3-EVO, 23.2R2-EVO, 23.4R2-EVO, 24.2R1-EVO, and all subsequent releases.

Workaround: There are no known workarounds for this issue. To reduce the risk of malicious exploitation, use access lists or firewall filters to limit access to the device via SNMPv3 only from trusted hosts.

Exploitation: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

References1

https://supportportal.juniper.net/JSA110074 (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-33799](https://cveledger.app/badge/CVE-2026-33799.svg)](https://cveledger.app/cve/CVE-2026-33799)

Record last updated 10 Jul 2026, 13:31 UTC.