Nine Junos Builds, One Flaw: Mapping CVE-2026-33792 to Your Fleet
The fixed-release list in an advisory is the least read part and the most operationally important. For CVE-2026-33792 it spans a wide set of trains, and the shape of that list tells you how much work a mixed estate faces.
The list as published
Juniper's JSA112186 names these Junos OS releases as carrying the fix for CVE-2026-33792 on SRX Series:
- 23.2R2-S7.7
- 23.4R2-S8.13
- 24.2R2-S5.5
- 24.4R2-S5
- 25.2R2-S2
- 25.4R1-S3
- 25.4R2
- 26.2R1-S2
- 26.2R2
- 26.4R1 All subsequent releases also include the fix. The advisory adds that for 23.2, 23.4 and 24.2 specific respins were referenced, and previously published builds were rebuilt.
What the shape of the list implies
Ten named builds across seven trains is a large back-port surface. It means the vendor treated the flaw as serious enough to fix in older trains rather than asking customers to move forward, and it means an estate spread across those trains needs a plan per train rather than one image.
The respin note is the operational sting. A device running 24.2 is not automatically fixed; a device running the rebuilt 24.2 build is. That distinction has to reach whoever closes the ticket.
Building the fleet map
The map has three columns and no more:
- device identifier;
- exact running build;
- whether the build is at or beyond the fixed build for its train. Anything else is context. The third column is what an auditor will ask for, and it can only be filled by reading the identifier from the device.
Why asset databases are not enough
Inventory systems record what was true at the last discovery. A device upgraded outside that cycle shows the old version, and a device running a rebuilt build may show a train-level string that looks identical to the vulnerable one.
Treat the database as a starting point for the map, not as the map.
Judging the flaw while the map is incomplete
The vulnerability requires a configured, reachable GRE tunnel. CVSS 3.1 rates it 9.8, CVSS 4.0 rates it 9.3, CWE-121, in srxpfe on Junos OS for SRX Series. There is no published workaround.
A device with no GRE configured is not exposed to the described path even if its build is old. That does not make it safe in general, and it does not remove the need to patch, but it does justify ordering the work.
External counts, properly labelled
A ZoomEye query on the Junos fingerprint returned 1497 matching assets at the time of this analysis, and a broader Juniper query returned 343570. Neither tells you what a specific device runs, whether it terminates tunnels, or whether it is even an SRX platform. Use them for scale arguments only.
The map as the deliverable
The useful output of this advisory is not a patched device list. It is a current map from device to build to tunnel configuration, with a date attached. That artefact answers the next advisory faster than this one was answered.
References
- Juniper Networks security bulletin JSA112186: https://supportportal.juniper.net/JSA112186
- CVE.org record for CVE-2026-33792: https://www.cve.org/CVERecord?id=CVE-2026-33792
- CERT-BUND advisory WID-SEC-2026-3976: https://wid.cert-bund.de/content/public/content/b6a2aff7-6ffb-4195-8879-c9537ac004dd
