Junos OS CVE-2026-101940

Exploitation requires the target Junos OS / Junos OS Evolved device to have BOTH ISO-VPN and egress-protection configured and enabled - a non-default feature combination - and the attacker must be an already-configured BGP peer of the device sending a malicious BGP UPDATE. Although CVSS marks PR:N (no authentication, consistent with BGP's lack of session authentication), the requirement for a pre-established, operator-configured peering relationship is the key limiting factor: arbitrary Internet hosts cannot reach the vulnerable code path. Devices without ISO-VPN egress protection, or without the attacker as a configured peer, are not exploitable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.7 (High), driven entirely by availability impact - a NULL pointer dereference crashing the rpd routing daemon (denial of service), with no confidentiality or integrity impact (VC:N/VI:N). The network attack vector and PR:N nominally indicate unauthenticated remote exploitation, but the description scopes the attacker to a 'configured BGP peer,' meaning exploitation requires an established, operator-configured BGP peering session rather than arbitrary Internet reachability - this materially narrows the real-world attack surface versus what AV:N/PR:N alone implies. Exploitation is further gated by a non-default precondition: both ISO-VPN and egress-protection must be configured and enabled. No EPSS score, SSVC decision data, KEV listing, or POC is present in the provided intelligence, so there is no public-exploitation signal: this is a vendor-reported (Juniper) issue with no public exploit identified at time of analysis. Net assessment: a genuine high-availability-impact DoS for the specific population of Junos/Junos OS Evolved devices running ISO-VPN egress protection with BGP peers, but not a broadly exploitable 'anyone on the network' flaw - real priority is conditional on that configuration, not universal.

An attacker who controls or has compromised a device that is an already-configured BGP peer of a vulnerable Junos OS / Junos OS Evolved router (with ISO-VPN and egress-protection enabled) sends a crafted BGP UPDATE message. Processing the UPDATE triggers a NULL pointer dereference in the rpd routing daemon, crashing it and causing a denial of service. No public exploit code is identified at time of analysis; exploitation requires an existing BGP peering relationship rather than arbitrary network access.