PT-2026-31749 · Juniper Networks · J-Web+2

Published 2026-04-09 · Updated 2026-04-09 · CVE-2026-33779

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 22.4R3-S9, versions 23.2 before 23.2R2-S6, versions 23.4 before 23.4R2-S7, versions 24.2 before 24.2R2-S3, versions 24.4 before 24.4R2-S2, and versions 25.2 before 25.2R1-S2, 25.2R2.

Description A flaw exists in the J-Web component of Juniper Networks Junos OS on SRX Series that allows a Person-in-the-Middle (PITM) attacker to intercept communication between the device and Security Director (SD) cloud, potentially gaining access to confidential information and modifying it. The device does not sufficiently verify the received server certificate when connecting to the SD cloud.

Recommendations Update to Junos OS version 22.4R3-S9 or later. Update to Junos OS version 23.2R2-S6 or later. Update to Junos OS version 23.4R2-S7 or later. Update to Junos OS version 24.2R2-S3 or later. Update to Junos OS version 24.4R2-S2 or later. Update to Junos OS version 25.2R1-S2 or 25.2R2 or later.

Fix

Weakness Enumeration

CWE-296

Related Identifiers

CVE-2026-33779

Affected Products

J-Web

Junos

Security Director

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-33779 · Security Note
• https://kb.juniper.net/JSA107823 · Vendor Advisory
• https://twitter.com/CVEnew/status/2042364299872477620 · Twitter Post