Home

Description

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a local user with low privileges to read sensitive information. A local user with low privileges can execute the CLI command 'show mgd' with specific arguments which will expose sensitive information. This issue affects Junos OS: * all versions before 22.4R3-S8, * 23.2 versions before 23.2R2-S6, * 23.4 versions before 23.4R2-S6, * 24.2 versions before 24.2R2-S4, * 24.4 versions before 24.4R2-S1, * 25.2 version before 25.2R1-S2, 25.2R2; Junos OS Evolved: * all versions before 23.2R2-S6-EVO, * 23.4 version before 23.4R2-S6-EVO, * 24.2 version before 24.2R2-S4-EVO, * 24.4 versions before 24.4R2-S1-EVO, * 25.2 versions before 25.2R2-EVO.

PUBLISHED Reserved 2026-03-23 | Published 2026-04-09 | Updated 2026-04-10 | Assigner juniper




MEDIUM: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

MEDIUM: 6.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y/RE:M

Problem types

CWE-862 Missing Authorization

Product status

Default status
unaffected

Any version before 22.4R3-S8
affected

23.2 (semver) before 23.2R2-S6
affected

23.4 (semver) before 23.4R2-S6
affected

24.2 (semver) before 24.2R2-S4
affected

24.4 (semver) before 24.4R2-S1
affected

25.2 (semver) before 25.2R1-S2, 25.2R2
affected

Default status
unaffected

Any version before 23.2R2-S6-EVO
affected

23.4 (semver) before 23.4R2-S6-EVO
affected

24.2 (semver) before 24.2R2-S4-EVO
affected

24.4 (semver) before 24.4R2-S1-EVO
affected

25.2 (semver) before 25.2R2-EVO
affected

References

kb.juniper.net/JSA107866 vendor-advisory

cve.org (CVE-2026-33776)

nvd.nist.gov (CVE-2026-33776)

Download JSON