Junos OS on SRX: weak certificate chain validation lets a PITM intercept Security Director cloud traffic

CVSS 8.3CVE-2026-33779Firmware, BMC & network fabriccurated

Impact

An SRX provisioned to talk to Security Director cloud does not sufficiently verify the server certificate it is handed, so anyone positioned between the firewall and the management cloud can terminate that session, read the credentials and other sensitive management data crossing it, and potentially modify what the device receives. For an operator the value at risk is management credentials for the security gateway that fronts the fleet, harvested without touching the device itself. Juniper rates integrity impact as low, so the realistic outcome is credential and configuration disclosure rather than direct takeover, but those credentials are the route to takeover afterwards. Attack complexity is rated high because the attacker needs to sit on the path.

Who can reach it

Unauthenticated attacker able to intercept traffic between the SRX and Security Director cloud - on the management path, an upstream network segment, or anywhere DNS or routing for that destination can be influenced. Only SRX devices provisioned to connect to SD cloud are affected.

What to do

Upgrade Junos OS to 22.4R3-S9, 23.2R2-S6, 23.4R2-S7, 24.2R2-S3, 24.4R2-S2, or 25.2R1-S2/25.2R2 for your train. That is a firewall reload, so plan it per device around your HA pair or a maintenance window. In the meantime, keep the SRX-to-SD-cloud path off any segment you do not control and rotate credentials that traversed it if you have reason to think the path was untrusted.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-33779 https://kb.juniper.net/JSA107823

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.