Compensating Controls Offered for Critical Junos SRX GRE Flaw

A breakdown of CVE-2026-33792 in Junos OS for SRX: a stack-based buffer overflow in srxpfe triggered by crafted packets on a configured GRE tunnel, rated CVSS 9.8, allowing unauthenticated root code execution or denial of service. Juniper published no workaround; the only fix is patched builds, while interim measures include narrowing permitted peers, moving GRE termination inward, wrapping it in IPsec and isolating management.

• CVE-2026-33792: stack overflow in srxpfe, CVSS 3.1 score 9.8, CVSS 4.0 score 9.3
• Exploitation needs no authentication or user interaction; impact is root or DoS
• Fixed builds: 23.2R2-S7.7, 24.4R2-S5, 25.4R2, 26.4R1 and later releases
• ZoomEye returned 1497 Junos-fingerprint assets at the time of analysis