BMP exists to copy routing information out of a router to a monitoring station. It is a telemetry feature, and features that only listen are often treated as low risk. Two of the October 2026 Junos vulnerabilities make the case that this assumption is wrong: CVE-2026-33789 and CVE-2026-33796 both reach a stack overflow through the monitoring path, and one of them needs no authenticated peer at all.
Vulnerability overview
CVE-2026-33789 is a stack-based buffer overflow in the routing protocol daemon of Juniper Networks Junos OS and Junos OS Evolved. Per NVD, an unauthenticated BGP peer can cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol is enabled.
CVE-2026-33796 is a stack-based buffer overflow in the same daemon. It allows a configured external BGP neighbour to execute arbitrary commands with root privileges via BMP route monitoring.
Both are rated 9.8 on the CVSS v3.1 scale. NVD shows a CVSS v4.0 base score of 9.2 for CVE-2026-33789 and 9.3 for CVE-2026-33796, both published 2026-10-14 and both marked "Awaiting Analysis". Neither is in CISA's Known Exploited Vulnerabilities catalog version 2026.10.23.
Mechanism and exploitation conditions
The pair differ in the trust level of the sender, and that difference is the most operationally useful fact in the advisory.
CVE-2026-33796 requires a configured external BGP neighbour, which is the ordinary case: an eBGP peer that has been explicitly configured and has completed session establishment. The crafted input arrives through BMP route monitoring, so the monitoring path is where the parsing error lives, but the sender must already be trusted enough to be a neighbour.
CVE-2026-33789 is described as exploitable by an unauthenticated BGP peer. That phrasing is unusual and should be read carefully. It does not mean the attacker can bypass TCP or the session state machine; it means the flaw can be triggered without the attacker possessing valid routing credentials beyond what an established adjacency provides. In environments that accept BGP sessions from customers, peers or transit partners, that is a materially wider set of potential triggers.
Both require BMP to be enabled. An operator who never configured a BMP station is not exposed to these two CVEs, even though the same device may be exposed to other flaws in the same bulletin.
Impact
Root-level command execution on the routing engine is the outcome both CVEs describe. From there, an attacker reaches configuration, routing state and, in practice, everything the device touches.
One consequence is specific to monitoring: BMP streams support route-leak detection, hijack analysis and forensic reconstruction. An attacker who can influence what the daemon does with BMP data, or force it to restart, degrades the visibility that an operations team depends on during an incident. Losing telemetry in the middle of a routing event is a bad time to lose it.
The denial-of-service path also has a multiplicative effect. The routing protocol daemon handles every BGP session on the device, so a crash affects all peers simultaneously and triggers reconvergence across the fabric.
Affected products and scope
The October 2026 fixed builds address both CVEs. Junos OS is affected on all versions prior to 23.2R2-S7.7, 23.4 before 23.4R2-S8.13, 24.2 before 24.2R2-S5.5, 24.4 before 24.4R2-S5, 25.2 before 25.2R2-S2, 25.4 before 25.4R1-S3 and 26.2 before 26.2R1-S2.
Junos OS Evolved is affected on all versions prior to 23.2R2-S7.7-EVO, 23.4 before 23.4R2-S8.11-EVO, 24.2 before 24.2R2-S5.6-EVO, 24.4 before 24.4R2-S5-EVO, 25.2 before 25.2R2-S2-EVO, 25.4 before 25.4R1-S3-EVO, 26.2 before 26.2R1-S2-EVO, the 23.4X100-EVO branch, 25.2X100 before 25.2X100-D35-EVO and 25.4X300 before 25.4X300-D40-EVO.
Exposure context
ZoomEye shows 343,949 assets matching app="Juniper" on the public internet. That measurement covers Juniper products broadly. It does not identify BMP configuration, and it does not distinguish routers from other Juniper platforms, so it belongs in a prioritisation discussion rather than in a vulnerability count.
Remediation and validation
Patch to the fixed build for the branch in use. Where BMP is not operationally required, disabling it removes the specific path described here and is a reasonable interim control. Where BMP is required, restrict which peers are considered neighbours and review whether every configured adjacency needs to exist.
Validation after the change should confirm the running release on each routing engine, check whether BMP stations remain configured, and review routing daemon logs for restarts. Because the described outcome includes root command execution, devices that were unpatched, had BMP enabled, and accepted sessions from untrusted peers should be reviewed for configuration changes rather than simply restarted on the new build.
References
Juniper security bulletin, October 2026: https://supportportal.juniper.net/s/article/2026-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Multiple-vulnerabilities-resolved
NVD record for CVE-2026-33789: https://nvd.nist.gov/vuln/detail/CVE-2026-33789
NVD record for CVE-2026-33796: https://nvd.nist.gov/vuln/detail/CVE-2026-33796
CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog