This vulnerability (CVE-2026-33773) in Juniper Junos OS arises from incorrect initialization of filtering resources in the packet forwarding engine on EX4100, EX4400, EX4650, and QFX5120 devices. When the same inet or inet6 filter is applied simultaneously on an IRB interface and a physical interface as an egress filter, only one filter is applied, potentially allowing traffic that should be blocked to pass through. This flaw affects Junos OS versions 23.4R2-S6 and 24.2R2-S3. The issue can be exploited remotely without authentication, impacting the integrity of downstream networks. Juniper manages remediation for this cloud service, and a patch is available.

The vulnerability allows an unauthenticated, network-based attacker to bypass intended egress filtering on affected Juniper devices, potentially sending unauthorized traffic to downstream networks. This results in an integrity impact but does not affect confidentiality or availability. The CVSS v3.1 base score is 5.8 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and a scope change with integrity impact only.

A patch is available for this vulnerability. Since Junos OS is provided as a cloud service, Juniper Networks manages remediation server-side. Users should verify with Juniper's official advisory and ensure their devices are updated to versions beyond 23.4R2-S6 and 24.2R2-S3 or apply the provided patches to mitigate the issue. No additional mitigation steps are indicated by the vendor advisory.