This vulnerability (CVE-2026-33800) in Juniper Junos OS MX Series Packet Forwarding Engine arises from unchecked input used as a loop condition. Specifically, Micro-BFD session flaps generate up/down events queued by PFEMAN. In Virtual-Chassis scenarios with locality-bias configured, processing each event is time-consuming. Continuous session flaps cause event queues to grow without completion, leading to PFEMAN watchdog timer expiration, which crashes and restarts the FPC, resulting in a denial-of-service. The vulnerability affects MX Series FPCs up to MPC9 and is remediated in versions 23.2R2-S7 and later for 23.2, 23.4R2-S8 and later for 23.4, 24.2R2-S4 and later for 24.2, 24.4R2-S3 and later for 24.4, and 25.2R2 and later for 25.2. The vendor manages remediation for this cloud-hosted service. No known exploits are reported in the wild.

An unauthenticated adjacent attacker can cause a denial-of-service by triggering continuous Micro-BFD session flaps, which overload event processing in the Packet Forwarding Engine. This leads to the PFEMAN watchdog timer expiring and the FPC crashing and restarting, causing a complete service outage on affected MX Series devices up to MPC9. There is no impact on confidentiality or integrity, only availability is affected.

A patch is available and should be applied. Fixed versions include 23.2R2-S7 and later for 23.2, 23.4R2-S8 and later for 23.4, 24.2R2-S4 and later for 24.2, 24.4R2-S3 and later for 24.4, and 25.2R2 and later for 25.2. Since this is a cloud-hosted service, Juniper typically manages remediation server-side; users should consult the vendor advisory for confirmation and update accordingly.