Juniper Patchday April 2026: Mehrere Schwachstellen
WID-SEC-2026-1022 · primera publicación 09.04.2026 · actualizado 10.04.2026 · CVSS 10,0
De qué se trata
Juniper Apstra (ehemals bekannt als AOS) automatisiert alle Aspekte der Rechnzentrums-Netzwerkplanung, des Aufbaus, der Bereitstellung und des Betriebs. JUNOS ist das "Juniper Network Operating System", das in Juniper Appliances verwendet wird. Die Switches der QFX-Serie von Juniper sichern und automatisieren Netzwerke in Rechenzentren. Die Juniper MX-Serie ist eine Produktfamilie von Routern. SRX Series Services Gateways ist ein Next-Generation Anti-Threat Firewall von Juniper. Junos Space ist eine Software-Plattform, die eine Reihe von Applikationen für das Netzwerkmanagement beinhaltet. Ein Angreifer kann mehrere Schwachstellen in Juniper Apstra, Junos OS, Junos OS Evolved und Junos Space ausnutzen, um erweiterte Berechtigungen – sogar Root-Rechte – zu erlangen, beliebigen Code auszuführen – auch mit erweiterten Berechtigungen –, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen oder Daten zu manipulieren.
¿En qué condiciones?
El BSI no indica requisitos especiales. Explotable a distancia según el BSI.
Lo que puede pasar en el peor de los casos
Un atacante podría aprovechar la vulnerabilidad para
- erweiterte Berechtigungen – sogar Root-Rechte – zu erlangen
- beliebigen Code auszuführen – auch mit erweiterten Berechtigungen –
- Sicherheitsmaßnahmen zu umgehen
- vertrauliche Informationen offenzulegen
- Cross-Site-Scripting-Angriffe durchzuführen oder Daten zu manipulieren
¿Me afecta?
Afectados según el BSI:
- Juniper Apstra <6.1.1
- Juniper JUNOS OS
- Juniper JUNOS OS Evolved
- Juniper QFX Series
- Juniper MX Series
- Juniper SRX Series
- Juniper Junos Space <24.1R5 Patch V3
La versión instalada suele aparecer en «Ayuda → Acerca de» o en la interfaz de administración del dispositivo.
¿Qué ayuda?
Actualizar como mínimo a:
- Juniper Apstra 6.1.1
- Juniper Junos Space 24.1R5 Patch V3
¿Se está explotando ya la vulnerabilidad?
Ninguna de las CVE figura en el catálogo de la CISA de vulnerabilidades explotadas. No significa que no haya ataques, solo que no hay ninguno documentado.
Información y fuentes
- Aviso original del BSI (WID)
- Juniper Patchday April 2026 vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Apstra: SSH host key validation vulnerability for managed devices (CVE-2025-13914) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - CTP OS: Configuring password requirements does not work which permits the use of weak passwords (CVE-2026-33771) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - JSI Virtual Lightweight Collector: Shell escape allows privilege escalation to root (CVE-2026-21915) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS and Junos OS Evolved: A high frequency of connecting and disconnecting netconf sessions causes management unavailability (CVE-2026-21919) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS and Junos OS Evolved: An attacker sending a specific genuine BGP packet causes a BGP reset (CVE-2026-33797) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS and Junos OS Evolved: CVE-2022-24805 resolved in net-SNMP vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS and Junos OS Evolved: Execution of crafted CLI commands allows for arbitrary shell injection as root (CVE-2026-33791) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS and Junos OS Evolved: In an EVPN-MPLS scenario churn of ESI routes causes a memory leak in l2ald (CVE-2026-33780) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS and Junos OS Evolved: Specific low privileged CLI command exposes sensitive information (CVE-2026-33776) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS and Junos OS Evolved: When an unsigned Python op script configuration is present, a local low privileged user can compromise the system (CVE-2026-33793) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS Evolved: Local, authenticated attackers can gain access to FPCs (CVE-2026-33788) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS Evolved: PTX Series: If SRTE tunnels provisioned via PCEP are present and specific gRPC queries are received evo-aftman crashes (CVE-2026-33783) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS Evolved: QFX5000 Series and PTX Series: An attacker sending crafted multicast packets will cause evo-aftmand / evo-pfemand to crash and restart (CVE-2025-59969) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS: A low privileged user can escalate their privileges so that they can login as root (CVE-2026-21916) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS: EX Series, QFX Series: If the same egress filter is configured on both an IRB and a physical interface one of those is not applied (CVE-2026-33773) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS: EX Series, QFX Series: In a VXLAN scenario when specific control protocol packets are received, memory leaks and eventually no traffic is passed (CVE-2026-33781) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS: MX Series: Firewall filters on lo0. in the default routing instance are not in effect (CVE-2026-33774) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS: MX Series: In specific DHCPv6 scenarios jdhcpd memory increases continuously with subscriber logouts (CVE-2026-33782) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS: MX Series: Mismatch between configured and received packet types causes memory leak in bbe-smgd (CVE-2026-33775) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands in a JDM/CSDS scenario (CVE-2026-33785) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS: Privileged local user can gain access to a Linux-based FPC as root (CVE-2025-30650) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS: SRX Series, MX Series: When a specifically malformed first ISAKMP packet is received kmd/iked crashes (CVE-2026-33778) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS: SRX Series: In a NAT64 configuration, receipt of a specific, malformed ICMPv6 packet will cause the srxpfe process to crash and restart. (CVE-2026-33790) vom 2026-04-08 supportportal.juniper.net
- Juniper Security Bulletin - Junos OS: SRX Series: Insufficient certificate verification for device to SD cloud communication (CVE-2026-33779) vom 2026-04-08 supportportal.juniper.net
y 4 fuentes más en el aviso original
CVE: CVE-2022-24805, CVE-2025-30650, CVE-2025-59969, CVE-2026-21915, CVE-2026-21916, CVE-2026-21919, CVE-2026-33771, CVE-2026-33773, CVE-2026-33774, CVE-2026-33775, CVE-2026-33776, CVE-2026-33778, CVE-2026-33779, CVE-2026-33780, CVE-2026-33781, CVE-2026-33782, CVE-2026-33783, CVE-2026-33784, CVE-2026-33785, CVE-2026-33786 …
Fuente: BSI, servicio de alertas e información (CERT-Bund); CISA. La valoración de las condiciones es mi lectura del texto del BSI; las páginas externas están en su idioma original.