Every CVE Search/ Get API key

CVE-2026-33776

Junos OS and Junos OS Evolved: Specific low privileged CLI command exposes sensitive information

6.8 Medium

CVE-2026-33776 is a medium vulnerability (CVSS 6.8) in Juniper Junos, published April 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.09%, the 0th percentile. No source names a fixed version.

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a local user with low privileges to read sensitive information.

A local user with low privileges can execute the CLI command 'show mgd' with specific arguments which will expose sensitive information.

This issue affects

Junos OS:

  • all versions before 22.4R3-S8,
  • 23.2 versions before 23.2R2-S6,
  • 23.4 versions before 23.4R2-S6,
  • 24.2 versions before 24.2R2-S4,
  • 24.4 versions before 24.4R2-S1,
  • 25.2 version before 25.2R1-S2, 25.2R2;

Junos OS Evolved:

  • all versions before 23.2R2-S6-EVO,
  • 23.4 version before 23.4R2-S6-EVO,
  • 24.2 version before 24.2R2-S4-EVO,
  • 24.4 versions before 24.4R2-S1-EVO,
  • 25.2 versions before 25.2R2-EVO.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.09%Up 0.1 points since Apr 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.8

Junos OS and Junos OS Evolved: Specific low privileged CLI command exposes sensitive information

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a local user with low privileges to read sensitive information.

A local user with low privileges can execute the CLI command 'show mgd' with specific arguments which will expose sensitive information.

This issue affects

Junos OS:

  • all versions before 22.4R3-S8,
  • 23.2 versions before 23.2R2-S6,
  • 23.4 versions before 23.4R2-S6,
  • 24.2 versions before 24.2R2-S4,
  • 24.4 versions before 24.4R2-S1,
  • 25.2 version before 25.2R1-S2, 25.2R2;

Junos OS Evolved:

  • all versions before 23.2R2-S6-EVO,
  • 23.4 version before 23.4R2-S6-EVO,
  • 24.2 version before 24.2R2-S4-EVO,
  • 24.4 versions before 24.4R2-S1-EVO,
  • 25.2 versions before 25.2R2-EVO.
Record
CVE-2026-33776
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y/RE:M
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-862
Updated
2026-11-02
EUVDEUVD-2026-21196 6.8

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a local user with low privileges to read sensitive information.

A local user with low privileges can execute the CLI command 'show mgd' with specific arguments which will expose sensitive information.

This issue affects

Junos OS:

  • all versions before 22.4R3-S8,
  • 23.2 versions before 23.2R2-S6,
  • 23.4 versions before 23.4R2-S6,
  • 24.2 versions before 24.2R2-S4,
  • 24.4 versions before 24.4R2-S1,
  • 25.2 version before 25.2R1-S2, 25.2R2;

Junos OS Evolved:

  • all versions before 23.2R2-S6-EVO,
  • 23.4 version before 23.4R2-S6-EVO,
  • 24.2 version before 24.2R2-S4-EVO,
  • 24.4 versions before 24.4R2-S1-EVO,
  • 25.2 versions before 25.2R2-EVO.
Record
EUVD-2026-21196
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y/RE:M
Updated
2026-11-02
GitHub AdvisoriesGHSA-cp8x-pvqx-wpcc 6.8

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS and Junos OS...

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a local user with low privileges to read sensitive information.

A local user with low privileges can execute the CLI command 'show mgd' with specific arguments which will expose sensitive information.

This issue affects

Junos OS:

  • all versions before 22.4R3-S8,
  • 23.2 versions before 23.2R2-S6,
  • 23.4 versions before 23.4R2-S6,
  • 24.2 versions before 24.2R2-S4,
  • 24.4 versions before 24.4R2-S1,
  • 25.2 version before 25.2R1-S2, 25.2R2;

Junos OS Evolved:

  • all versions before 23.2R2-S6-EVO,
  • 23.4 version before 23.4R2-S6-EVO,
  • 24.2 version before 24.2R2-S4-EVO,
  • 24.4 versions before 24.4R2-S1-EVO,
  • 25.2 versions before 25.2R2-EVO.
Record
GHSA-cp8x-pvqx-wpcc
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-862
Updated
2026-11-02
NVD 6.8

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a local user with low privileges to read sensitive information.

A local user with low privileges can execute the CLI command 'show mgd' with specific arguments which will expose sensitive information.

This issue affects

Junos OS:

  • all versions before 22.4R3-S8,
  • 23.2 versions before 23.2R2-S6,
  • 23.4 versions before 23.4R2-S6,
  • 24.2 versions before 24.2R2-S4,
  • 24.4 versions before 24.4R2-S1,
  • 25.2 version before 25.2R1-S2, 25.2R2;

Junos OS Evolved:

  • all versions before 23.2R2-S6-EVO,
  • 23.4 version before 23.4R2-S6-EVO,
  • 24.2 version before 24.2R2-S4-EVO,
  • 24.4 versions before 24.4R2-S1-EVO,
  • 25.2 versions before 25.2R2-EVO.
Record
CVE-2026-33776
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-862
Updated
2026-11-02

Affected products

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open