Juniper Junos OS CVE-2026-101948

Requires an established BGP session between the attacker and the affected device, and the attacker must be able to send a BGP FlowSpec update on that session - i.e., FlowSpec address families must be in use/accepted on the peering. No special authentication beyond the existing peering relationship is needed (PR:N), and no user interaction is required (UI:N). The principal limiting factor is the BGP peering prerequisite: the attacker must already be a configured neighbor (or able to inject into that session), so routers peering only with fully trusted internal neighbors face lower realistic risk than those peering with external or untrusted parties. Only the listed Junos OS and Junos OS Evolved release trains below the fixed versions (e.g. 25.2 <25.2R2-S2, 25.4 <25.4R1-S3, 26.2 <26.2R1-S2, and Evolved equivalents) are affected.

This is a credible operational priority for networks running affected Junos OS / Junos OS Evolved versions, though less severe than the 8.7 score might suggest in isolation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a low-complexity, remote, unauthenticated trigger, and the impact is availability-only (VA:H, SA:L) - rpd crash causes a routing denial of service with no confidentiality or integrity loss. The critical nuance the raw vector understates: exploitation requires the attacker to be an established BGP peer of the target, so 'unauthenticated' here means no additional credentials beyond an already-configured peering relationship, not arbitrary internet-wide reachability. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a real, patch-now issue for operators peering with untrusted or internet-facing BGP neighbors, but the peering prerequisite meaningfully narrows the realistic attack surface versus a true unauthenticated-from-anywhere flaw.

An attacker who controls or compromises a device in an established BGP peering relationship with an affected Junos router sends a specially crafted BGP FlowSpec update over the session. The malformed update triggers a NULL pointer dereference in the routing protocol daemon (rpd), crashing it and disrupting routing until it restarts. No public exploit code is identified at time of analysis, and low attack complexity (AC:L) means a single crafted FlowSpec message suffices once a session exists.