Juniper Junos OS CVE-2026-101945

Exploitation requires the target to run an EVPN-enabled routing instance on Junos OS or Junos OS Evolved AND an already-established EVPN BGP peering relationship between the attacker-controlled endpoint and the victim's rpd - the attacker must therefore be a configured/trusted BGP neighbor or have compromised one, not an arbitrary internet host. The specific trigger is malformed EVPN BGP route processing that causes an integer overflow (CWE-190). Limiting factors: EVPN is a non-default, deliberately configured feature; the peering trust relationship must pre-exist; impact is availability-only (control-plane DoS) with no confidentiality or integrity effect. These constraints meaningfully narrow realistic exploitation to EVPN deployments and adjacent/compromised peers despite the network attack vector.

The vendor-supplied CVSS 4.0 base score of 8.7 (AV:N/AC:L/PR:N/UI:N) with VA:H and subsequent-system SA:L reflects a high-severity, network-reachable denial of service against the rpd routing process, and the supplemental metrics reinforce priority (AU:Y automatable, R:A recovery requires action). However, these raw metrics materially overstate exposure: the description explicitly requires 'an established EVPN BGP peering relationship,' meaning only a configured, trusted BGP neighbor (or an attacker who has compromised/spoofed such a peer) can deliver the malicious route updates - this is a significant gating condition that PR:N does not capture. No EPSS probability was provided, there is no CISA KEV listing, and no proof-of-concept is referenced, so this is 'no public exploit identified at time of analysis.' Net assessment: a genuine priority for operators running EVPN fabrics (service providers, data-center overlays) because the impact is control-plane outage and the trigger is automatable once peering exists, but NOT a broadly internet-exploitable mass-threat given the trust-relationship prerequisite. Missing data to note: no affected-version list beyond wildcard CPEs, and no EPSS/KEV signals to corroborate real-world exploitation likelihood.

An attacker controlling or having compromised a device that holds an established EVPN BGP peering session with a target Junos OS / Junos OS Evolved router sends crafted EVPN BGP route updates. Processing these in rpd triggers an integer overflow that crashes the routing process, dropping control-plane adjacencies and causing a denial of service across the EVPN-enabled routing instance. No public exploit code is identified at the time of analysis.