CVE-2026-33793

CWE-250Published: April 9, 2026· Updated: Apr 16, 2026

7.8

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:2.4th

Official Description

An Execution with Unnecessary Privileges vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to gain root privileges, thus compromising the system.

When a configuration that allows unsigned Python op scripts is present on the device, a non-root user is able to execute malicious op scripts as a root-equivalent user, leading to privilege escalation.

This issue affects Junos OS:

* All versions before 22.4R3-S7,

* from 23.2 before 23.2R2-S4,

* from 23.4 before 23.4R2-S6,

* from 24.2 before 24.2R1-S2, 24.2R2,

* from 24.4 before 24.4R1-S2, 24.4R2;

Junos OS Evolved:

* All versions before 22.4R3-S7-EVO,

* from 23.2 before 23.2R2-S4-EVO,

* from 23.4 before 23.4R2-S6-EVO,

* from 24.2 before 24.2R2-EVO,

* from 24.4 before 24.4R1-S1-EVO, 24.4R2-EVO.

NVD Source

Technical Analysis

CVE-2026-33793 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.

A proof-of-concept (PoC) exploit exists for CVE-2026-33793. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.