CVE-2026-33789 and CVE-2026-33796: How BGP Monitoring Protocol Became an Attack Surface on Junos
CVE-2026-33789 and CVE-2026-33796: How BGP Monitoring Protocol Became an Attack Surface on Junos BMP exists to copy routing information out of a router to a monitoring station. It is a telemetry feature, and features that only listen are often treated as low risk. Two of the October 2026 Junos vulnerabilities make the case that this assumption is wrong: CVE-2026-33789 and CVE-2026-33796 both…
Two recently discovered vulnerabilities in the BGP Monitoring Protocol (BMP) for Juniper Networks' Junos OS and Junos OS Evolved expose the telemetry feature as an attack surface. Both CVE-2026-33789 and CVE-2026-33796 result in stack-based buffer overflows in the routing protocol daemon, leading to root-level command execution.
The vulnerabilities can be exploited by either an unauthenticated BGP peer or a configured external BGP neighbour, making the attack surface broader than initially assumed. The impact of these vulnerabilities is significant, as root-level command execution allows attackers to gain full control over the routing engine, affecting configuration, routing state, and potentially all aspects touched by the device.
The denial-of-service consequence arises due to the routing protocol daemon handling every BGP session, causing a crash that affects all peers simultaneously and disrupts incident response efforts. Affected versions of Junos OS and Junos OS Evolved include various releases prior to 26.2R1-S2-EVO. To mitigate the risk, users should apply the fixed build for their respective branch, disable BMP if not operationally required, restrict which peers are considered neighbours, and review routing daemon logs for any unexpected restarts.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
