Junos OS CVE-2026-101944

Exploitation requires that the attacker send crafted EVPN route updates from an already-accepted EVPN BGP peer - meaning a configured, established EVPN BGP peering session must exist and the attacker must control or compromise that peer endpoint. This is confirmed by the description ('from an accepted EVPN BGP peer') and the CVSS AU:Y flag. The device must be running EVPN with BGP signaling; routers without EVPN configured or without the attacker-controlled device in their accepted-peer set are not exposed. This peer-trust requirement is the primary limiting factor and significantly reduces the realistic attacker population despite the network attack vector; no user interaction is required (UI:N) and impact is limited to availability (no confidentiality or integrity impact).

This is a genuine operational priority for Juniper-based networks, though not a mass-exploitation threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) with a base of 8.7 reflects a network-reachable, low-complexity flaw that fully compromises availability of the routing daemon. However, the vector's AU:Y flag and the description's phrase 'from an accepted EVPN BGP peer' are the decisive signals: exploitation is gated on the attacker already being a configured, accepted EVPN BGP peer - a trust relationship, not an open Internet-facing service. This meaningfully constrains the realistic attacker population to compromised or malicious peering partners, so the PR:N in the vector understates the practical barrier and should be read alongside AU:Y. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or public exploit code - the risk is latent capability against a widely deployed carrier/enterprise platform rather than demonstrated in-the-wild use. The rpd crash degrades routing availability (VA:H) with a low subsequent-system availability impact (SA:L), consistent with a BGP/routing outage that can ripple to dependent systems.

An attacker who controls or has compromised a device in an existing EVPN BGP peering relationship with a vulnerable Junos OS or Junos OS Evolved router sends specially crafted EVPN route updates. An integer overflow in the routing protocol daemon (rpd) is triggered while processing these updates, crashing or hanging rpd and causing a denial of service that disrupts routing. The network attack vector and low complexity make the trigger reliable once a trusted peering session is established, but no public exploit code was identified in the provided intelligence.