CVE-2026-33802 is a missing authorization vulnerability (CWE-862) in the CLI of Juniper Networks Junos OS on EX Series switches (EX2300, EX4000, EX4100, EX4300-MP, EX4400). An authenticated local attacker with no specific permissions can execute a privileged 'request' CLI command that causes a denial-of-service impacting all traffic until automatic recovery. Affected versions include 23.2R2, 23.4, 24.2, 24.4, 25.2, and 25.4 prior to their respective patch releases (e.g., 23.2R2-S6, 23.4R2-S8, 24.2R2-S4, 24.4R2-S3, 25.2R2, 25.4R1-S1). The vulnerability is confirmed in Junos OS cloud service environments, with no known exploits in the wild. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicating local attack with low complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

An authenticated local attacker without specific permissions can cause a denial-of-service condition on affected Junos OS EX Series switches by executing a privileged CLI command. This results in complete traffic disruption until the system automatically recovers. There is no impact on confidentiality or integrity. The vulnerability affects network availability.

A patch is available for this vulnerability. Affected Junos OS versions prior to 23.2R2-S6, 23.4R2-S8, 24.2R2-S4, 24.4R2-S3, 25.2R2, and 25.4R1-S1 should be upgraded to these fixed releases or later. Since this is a cloud service environment, Juniper Networks manages remediation for the cloud-hosted service; users should consult the vendor advisory for confirmation and apply updates accordingly.