Orgs at Risk: Juniper SRX GRE Tunnel Flaw Allows Unauthenticated Root Code Execution

A stack-based buffer overflow in the srxpfe process of Juniper Networks Junos OS allows unauthenticated attackers to execute code as root. The flaw, identified as CVE-2026-33792, is triggered by a crafted packet received on a configured Generic Routing Encapsulation (GRE) tunnel. According to the National Vulnerability Database, this vulnerability carries a CVSS score of 9.8, rated as critical. The same record also lists a CVSS score of 9.3, which is also rated as critical.

How does the exploit work?

The vulnerability exists within the srxpfe process on SRX Series devices. An attacker sends a specifically crafted network packet to a configured GRE tunnel interface. The source material identifies the weakness as a stack-based buffer overflow. This allows an unauthenticated network attacker to execute code as root or cause a denial of service. The attacker does not need valid credentials to send the packet to the tunnel endpoint. The NVD classifies the weakness under CWE-121.

What is the impact on systems?

Successful exploitation grants the attacker remote code execution capabilities with root privileges. Alternatively, the attacker can trigger a denial of service condition. According to the NVD, the vulnerability allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet. The ability to run code as root is the primary impact described. The NVD does not specify additional consequences beyond code execution and service disruption.

Which versions are affected?

The vulnerability affects specific maintenance releases of Junos OS running on SRX Series hardware. According to the NVD record, affected versions include those before 23.2R2-S7.7, before 23.4R2-S8.13, before 24.2R2-S5.5, and before 24.4R2-S5. Organizations running these specific software versions are exposed to the risk. The NVD does not list affected versions for the secondary CVSS 9.3 entry, but the primary advisory covers the specified release lines. Any SRX device running a version older than the listed thresholds is vulnerable.

Is there a fix available?

The NVD record identifies the vulnerable versions but does not explicitly state that a patch has been released or confirmed. The advisory lists version thresholds, implying that updates beyond those points may address the issue. However, without explicit confirmation of a fix in the source material, no patch can be guaranteed. Organizations should monitor vendor communications for official remediation guidance. Until a confirmed update is available, the risk remains active for unpatched systems.

What analysts watch for

Security teams usually monitor for unusual traffic patterns on GRE tunnel interfaces, as this is the attack vector. Analysts should examine logs for signs of the srxpfe process crashing or restarting unexpectedly, which may indicate a denial of service attempt. Checking for new user accounts or modified system binaries can reveal successful code execution. Teams should also look for outbound connections from the SRX device to unknown IP addresses, which could signal command-and-control communication. Regular integrity checks of the operating system files are essential for detecting unauthorized changes.

Background: CVSS score

The Common Vulnerability Scoring System assigns a numerical value to software flaws based on how easy they are to exploit and how much damage they cause. It uses a standardized formula so teams can compare risks across different products. The base score reflects the vulnerability itself, while temporal and environmental scores adjust for real-world conditions like patches or network exposure.

Read the full guide: CVSS Score Explained: What the Number Actually Means for Your Code

What to do and how to stay safe: Juniper Networks

• Audit all SRX Series devices to determine if they run Junos OS versions prior to 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, or 24.4R2-S5.
• Review firewall logs for anomalies in GRE tunnel traffic, such as unexpected packet sizes or high volumes of malformed packets.
• Restrict access to GRE tunnel endpoints using source IP filtering if possible, to reduce the attack surface.
• Monitor system integrity for unauthorized changes to the srxpfe process or new user accounts created with root privileges.

Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-33792?

It is a stack-based buffer overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series devices.

Can an attacker exploit this flaw remotely?

Yes, an unauthenticated network attacker can exploit it by sending a crafted packet to a configured GRE tunnel.

What are the potential consequences of exploitation?

Attackers can execute code as root or cause a denial of service on the affected SRX Series device.