Junos OS (SRX firewalls)
CVE-2026-33792: SRX Series: An attacker causes remote code execution and denial of service when a GRE tunnel is configured
A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet received on a configured GRE tunnel.
Published Juniper Networks advisory JSA112186
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (SRX Series) 0 | 23.2R2-S7.7 or later |
| Junos OS (SRX Series) 23.4 | 23.4R2-S8.13 or later |
| Junos OS (SRX Series) 24.2 | 24.2R2-S5.5 or later |
| Junos OS (SRX Series) 24.4 | 24.4R2-S5 or later |
| Junos OS (SRX Series) 25.2 | 25.2R2-S2 or later |
| Junos OS (SRX Series) 25.4 | 25.4R1-S3 or later |
| Junos OS (SRX Series) 26.2 | 26.2R1-S2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
A stack-based buffer overflow in the srxpfe process of Junos OS on SRX Series firewalls allows an unauthenticated network attacker to execute code as root or cause a denial of service. The attacker sends a crafted packet to a configured GRE tunnel, requiring no login or user interaction to exploit the flaw.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet received on a configured GRE tunnel.
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.