This vulnerability (CVE-2026-33774) involves an improper check for unusual or exceptional conditions (CWE-754) in the packet forwarding engine of Juniper Networks Junos OS on MX Series devices. Specifically, firewall filters applied to non-zero loopback interfaces (lo0.n) in the global VRF/default routing instance do not get executed, allowing bypass of firewall filtering. Affected devices include MX platforms with MPC10, MPC11, LC4800, or LC9600 line cards and Junos OS versions before 23.2R2-S6, 23.4 versions before 23.4R2-S7, 24.2 versions before 24.2R2, and 24.4 versions before 24.4R2. The vulnerability enables an unauthenticated network attacker to access the control plane by circumventing firewall filters. The issue can be verified by observing that firewall counters for the filter show no matches despite traffic. No vendor advisory or patch links are provided in the data, and the remediation level is unspecified.

An unauthenticated attacker on the network can bypass firewall filters applied to certain loopback interfaces on affected Junos OS MX Series devices, potentially gaining unauthorized access to the device's control plane. This could lead to information disclosure or limited control-plane impact. The CVSS score of 6.5 reflects a medium severity with low attack complexity, no privileges required, and no user interaction needed. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The affected Junos OS versions are identified, and fixed versions appear to be 23.2R2-S6 or later, 23.4R2-S7 or later, 24.2R2 or later, and 24.4R2 or later. Until an official patch or update is applied, administrators should avoid applying firewall filters on non-zero loopback interfaces in the default routing instance or consider alternative configurations to mitigate bypass risk. Monitor Juniper Networks advisories for official fixes and guidance.