This vulnerability (CVE-2026-33788) involves missing authentication controls in the Flexible PIC Concentrators of Juniper Networks Junos OS Evolved running on PTX Series devices. A local attacker with low privileges can escalate to high-privileged access on the FPCs, potentially compromising the component fully. Affected versions include all releases before 21.2R3-S8-EVO, 21.4-EVO before 21.4R3-S7-EVO, 22.2-EVO before 22.2R3-S4-EVO, 22.3-EVO before 22.3R3-S3-EVO, 22.4-EVO before 22.4R3-S2-EVO, and 23.2-EVO before 23.2R2-EVO. The CVSS v3.1 score is 7.8, indicating high severity with local attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Juniper manages remediation for this cloud-hosted service.

An authenticated local user with low privileges can gain high-privileged access to Flexible PIC Concentrators on affected Junos OS Evolved PTX devices, potentially leading to full compromise of these components. This can impact confidentiality, integrity, and availability of the affected system components.

A patch is available for this vulnerability. Since Junos OS Evolved on PTX Series is a cloud service, Juniper Networks manages remediation server-side. Users should verify with Juniper's official advisories that their systems are updated to versions 21.2R3-S8-EVO or later, 21.4R3-S7-EVO or later, 22.2R3-S4-EVO or later, 22.3R3-S3-EVO or later, 22.4R3-S2-EVO or later, or 23.2R2-EVO or later to ensure mitigation. No additional user action is required beyond confirming the update status.