CVE-2026-33802 is a CWE-862 Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on EX Series switches (EX2300, EX4000, EX4100, EX4300-MP, EX4400). An authenticated local attacker with no specific permissions can execute a privileged 'request' CLI command that causes a denial-of-service by impacting all traffic until automatic recovery. Affected versions include 23.2R2 before 23.2R2-S6, 23.4 before 23.4R2-S8, 24.2 before 24.2R2-S4, 24.4 before 24.4R2-S3, 25.2 before 25.2R2, and 25.4 before 25.4R1-S1. The vulnerability has a CVSS 3.1 base score of 5.5 (medium severity) with local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. Juniper manages remediation for this cloud-hosted service and a patch is available.

An authenticated local attacker without specific permissions can cause a denial-of-service condition on affected Junos OS EX Series switches by executing a privileged CLI command. This results in complete traffic disruption until the system automatically recovers. There is no confidentiality or integrity impact reported.

A patch is available for this vulnerability. Users should upgrade affected Junos OS versions to the fixed releases: 23.2R2-S6 or later, 23.4R2-S8 or later, 24.2R2-S4 or later, 24.4R2-S3 or later, 25.2R2 or later, and 25.4R1-S1 or later. Since this is a cloud-hosted service, Juniper Networks manages remediation for the service; users should consult the vendor advisory for detailed patching instructions and confirm their systems are updated accordingly.