CVE-2026-33793
Published: 09 April 2026
Summary
CVE-2026-33793 is a high-severity Execution with Unnecessary Privileges (CWE-250) vulnerability in Juniper Junos. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-7 (Least Functionality).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces the principle of least privilege, preventing low-privileged users from executing Python op scripts with unnecessary root-equivalent privileges.
Requires timely identification, reporting, and correction of flaws like CVE-2026-33793 through patching Junos OS to eliminate the privilege escalation vulnerability.
Restricts systems to least functionality by prohibiting or restricting unnecessary capabilities such as configurations allowing execution of unsigned Python op scripts.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a local privilege escalation (CWE-250) where a low-privileged user executes a malicious unsigned Python op script to gain root-equivalent access, directly enabling T1068 (Exploitation for Privilege Escalation) via T1059.006 (Python scripting).
NVD Description
An Execution with Unnecessary Privileges vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to gain root privileges, thus compromising the system. When a configuration that allows unsigned Python…
more
op scripts is present on the device, a non-root user is able to execute malicious op scripts as a root-equivalent user, leading to privilege escalation. This issue affects Junos OS: * All versions before 22.4R3-S7, * from 23.2 before 23.2R2-S4, * from 23.4 before 23.4R2-S6, * from 24.2 before 24.2R1-S2, 24.2R2, * from 24.4 before 24.4R1-S2, 24.4R2; Junos OS Evolved: * All versions before 22.4R3-S7-EVO, * from 23.2 before 23.2R2-S4-EVO, * from 23.4 before 23.4R2-S6-EVO, * from 24.2 before 24.2R2-EVO, * from 24.4 before 24.4R1-S1-EVO, 24.4R2-EVO.
Deeper analysisAI
CVE-2026-33793 is an Execution with Unnecessary Privileges vulnerability (CWE-250) in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved. It affects Junos OS versions prior to 22.4R3-S7, from 23.2 prior to 23.2R2-S4, from 23.4 prior to 23.4R2-S6, from 24.2 prior to 24.2R1-S2 or 24.2R2, and from 24.4 prior to 24.4R1-S2 or 24.4R2. Junos OS Evolved is similarly impacted in versions prior to 22.4R3-S7-EVO, from 23.2 prior to 23.2R2-S4-EVO, from 23.4 prior to 23.4R2-S6-EVO, from 24.2 prior to 24.2R2-EVO, and from 24.4 prior to 24.4R1-S1-EVO or 24.4R2-EVO.
A local attacker with low privileges can exploit this issue if the device configuration permits unsigned Python op scripts. By executing a malicious op script, the non-root user escalates to root-equivalent privileges, fully compromising the system with high confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity for local access scenarios.
The Juniper security advisory (JSA103142) at https://supportportal.juniper.net/JSA103142 details mitigation steps, including upgrading to the patched versions listed above that resolve the vulnerability.
Details
- CWE(s)