SecOps SignalSecurity Intelligence Workspace
Loading collection status
Vulnerabilities/CVE-2026-33775Public Intelligence Dossier
Source: juniper · Limited verification•Last verified: •Collection Degraded
CVE-2026-33775Unknown / EvaluatingHIGH (raw)CVSS 7.1CWE-401

A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS)

Published: 10 Apr 2026•Last updated: 27 Oct 2026, 03:40 AM IST•Source identifier: sirt@juniper.net
Dossier completeness: source-provided sections 2 / 3 · rule guidance not available. Missing source facts count as incomplete.
Official source
CISA KEV catalog
Unknown
KEV status was not determined.
CVSS score
7.1HIGH (raw)
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X
Metric sourcesirt@juniper.net
EPSS probability
0.2%0.002
Percentile9th
Weakness type
CWE-401
No further CWE recorded
Remediation
Patch status unknown
No fixed version or KB recorded

Why It Matters

Analysis dossier

Why It Matters

A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS). If the authentication packet-type option is configured and a received packet does not match that packet type, the memory leak occurs. When all memory available to bbe-smgd has been consumed, no new subscribers will be able to login. The memory utilization of bbe-smgd can be monitored with the following show command: user@host> show system processes extensive | match bbe-smgd The below log message can be observed when this limit has been reached: bbesmgd[ ]: %DAEMON-3-SMD_DPROF_RSMON_ERROR: Resource unavailability, Reason: Daemon Heap Memory exhaustion This issue affects Junos OS on MX Series: * all versions before 22.4R3-S8, * 23.2 versions before 23.2R2-S5, * 23.4 versions before 23.4R2-S6, * 24.2 versions before 24.2R2-S2, * 24.4 versions before 24.4R2, * 25.2 versions before 25.2R2.

SOC priority

High

Actively exploited (source statement)

Unknown

Publicly disclosed

Unknown

Risk basis: Microsoft or Microsoft-managed product relevance; HIGH severity; Source severity; no confirmed exploitation signal

Affected Products & Remediation

1 source-backed product
Affected products and versions (source)
  • juniper junos · < 22.4; 22.4; 23.2; 23.4; 24.2; 24.4; 25.2 · NVD CPE · Source
NVD applicability prerequisites: cpe:2.3:h:juniper:mx10004:-:*:*:*:*:*:*:*, cpe:2.3:h:juniper:mx10008:-:*:*:*:*:*:*:*, cpe:2.3:h:juniper:mx2008:-:*:*:*:*:*:*:*, cpe:2.3:h:juniper:mx2010:-:*:*:*:*:*:*:*, cpe:2.3:h:juniper:mx2020:-:*:*:*:*:*:*:*, cpe:2.3:h:juniper:mx204:-:*:*:*:*:*:*:*, cpe:2.3:h:juniper:mx240:-:*:*:*:*:*:*:*, cpe:2.3:h:juniper:mx301:-:*:*:*:*:*:*:*, cpe:2.3:h:juniper:mx304:-:*:*:*:*:*:*:*, cpe:2.3:h:juniper:mx480:-:*:*:*:*:*:*:*. These are conditions, not proof that an environment is exposed or unaffected.
Recorded patch / KBNot provided by source

Vendor or catalog guidance (source)

Not provided by source

Known exploitation (source facts)

Only what a source states. Unknown means no source has said either way; it is not "not exploited".

CISA KEV
Unknown
Exploited (source statement)
Unknown
Publicly disclosed (source)
Unknown

Suggested hunting (rule-based inference)

SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.

No rule-based guidance for this vulnerability class

CISA KEV Record

CISA KEV status was not determined for this record.

Change History & Source Data

— No recorded material change

CNA / source
sirt@juniper.net
Record status · verification
UPDATED · NVD API
CPE
cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*, cpe:2.3:o:juniper:junos:22.4:-:*:*:*:*:*:*, cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*, cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:*, cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:*, cpe:2.3:o:juniper:junos:22.4:r2:*:*:*:*:*:*, cpe:2.3:o:juniper:junos:22.4:r2-s1:*:*:*:*:*:*, cpe:2.3:o:juniper:junos:22.4:r2-s2:*:*:*:*:*:*, cpe:2.3:o:juniper:junos:22.4:r3:*:*:*:*:*:*, cpe:2.3:o:juniper:junos:22.4:r3-s1:*:*:*:*:*:*

Evidence & Provenance

2 public sources
kb.juniper.netSource recordnvd.nist.govSource record

Linked by the query's stored exact CVE association. Review required tables and validation status before use.

Detection Hunting Query
Target: DeviceTvmSoftwareVulnerabilities•Defender XDR
Detect endpoints exposed to CVE-2026-33775
Purpose: Exposure assessment (Category: Exposure Check)Why linked: Query metadata names CVE-2026-33775
DeviceTvmSoftwareVulnerabilities| where CveId == "CVE-2026-33775"| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId| sort by VulnerabilitySeverityLevel desc
Schema Checked · Not runtime validatedSource: SecOps Signal deterministic template · Limited verificationStatic screening: Passed structure and schema checks; tenant execution is not verified.
Open KQL Library

Looking up related community queries…

Loading related intelligence

Correlated briefings

SecOps Signal surfaces public advisory facts only. A missing value means the source has not published it, not that your environment is unaffected. No tenant inventory is connected.