Two Junos flaws with CVSS 9.8 reach root via BGP Monitoring Protocol

Juniper Junos OS and Junos OS Evolved contain CVE-2026-33789 and CVE-2026-33796, stack overflows in the routing protocol daemon reachable through BMP that allow root-level command execution. One is triggerable by an unauthenticated BGP peer, the other by a configured external neighbour; both require BMP enabled.

• Both flaws are rated CVSS 9.8 and were published on October 14, 2026
• CVE-2026-33789 needs no authentication; CVE-2026-33796 comes from a configured eBGP neighbour
• Fixes ship in branches 23.2R2-S7.7, 24.4R2-S5, 25.4R1-S3 and 26.2R1-S2
• Neither is yet in CISA's Known Exploited Vulnerabilities catalog