This vulnerability (CVE-2026-33774) in Juniper Networks Junos OS affects MX Series devices with certain line cards and specific Junos OS versions before 23.2R2-S6, 23.4R2-S7, 24.2R2, and 24.4R2. It arises from improper checking of firewall filters applied on non-zero loopback interfaces (lo0.n) when these interfaces are in the global VRF (default routing instance). As a result, firewall filters configured on these interfaces do not get executed, allowing an unauthenticated network attacker to bypass the firewall filter and potentially access the control-plane of the device. The issue can be observed by the absence of firewall counter matches for the filter. The vulnerability is classified under CWE-754 (Improper Check for Unusual or Exceptional Conditions). No vendor advisory or patch information is currently provided.

An unauthenticated, network-based attacker can bypass configured firewall filters on affected Junos OS MX Series devices, potentially gaining unauthorized access to the device control-plane. This could lead to information disclosure or unauthorized control-plane interactions. The impact is limited to devices with specific line cards and configurations involving non-zero loopback interfaces in the default routing instance. The CVSS v3.1 base score is 6.5, indicating a medium severity with low complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review configurations to avoid applying firewall filters on non-zero loopback interfaces (lo0.n) in the global VRF/default routing instance on affected MX Series devices. Monitor Juniper Networks advisories for updates and apply patches promptly once released.