This vulnerability (CVE-2026-33788) in Juniper Networks Junos OS Evolved on PTX Series devices is due to missing authentication for critical functions in the Flexible PIC Concentrators (FPCs). A local user with low privileges who is authenticated can escalate privileges to gain direct high privileged access to the installed FPCs. The affected versions include all versions before 21.2R3-S8-EVO, and several subsequent EVO versions prior to specific patch releases. The CVSS v3.1 score is 7.8, indicating high severity with local attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Juniper manages remediation for this cloud-hosted service, and a patch is available.

A local, authenticated attacker with low privileges can gain high privileged access to Flexible PIC Concentrators on affected Junos OS Evolved PTX devices. This can lead to a full compromise of the affected component, impacting confidentiality, integrity, and availability. No known exploits are reported in the wild currently.

A patch is available for this vulnerability. Since Junos OS Evolved on PTX Series is a cloud-hosted service, Juniper Networks manages the remediation server-side. Users should verify with Juniper's official advisory and ensure their devices are updated to the fixed versions: 21.2R3-S8-EVO or later, 21.4R3-S7-EVO or later, 22.2R3-S4-EVO or later, 22.3R3-S3-EVO or later, 22.4R3-S2-EVO or later, and 23.2R2-EVO or later. No additional mitigation actions are indicated by the vendor advisory.