Junos OS Evolved CVE-2026-101960

Exploitation requires the QFX5240, QFX5241, or QFX5250 to be explicitly configured for BGP global-load-balancing AND to have more than 128 ECMP next-hops - a specific, non-default operator configuration; devices without this configuration are not affected. The attacker must also have adjacent-network access as or on-path to a BGP peer (AV:A), not arbitrary remote internet access. No authentication is required per the vector (PR:N), and no user interaction is needed (UI:N). The combination of specific hardware, a specific routing feature configuration, and required BGP adjacency substantially limits the realistic exploitable population despite the unauthenticated vector.

This is a moderate-severity, availability-only denial-of-service flaw, not a high-priority emergency. The vendor CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.5) indicates an adjacent-network attacker with no privileges can crash the routing protocol daemon (rpd), but with zero confidentiality or integrity impact - the only consequence is a daemon crash (CWE-787 out-of-bounds write). Critically, exploitation is gated by a specific non-default configuration: BGP global-load-balancing enabled AND more than 128 ECMP next-hops, on a narrow set of QFX5240/5241/5250 hardware running Junos OS Evolved. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization. The AV:A rating is consistent with the fact that an attacker would typically need to be an established/on-path BGP peer rather than an arbitrary internet host. In short: a real but narrow DoS requiring attacker adjacency plus a specific operator configuration - manageable priority, well below a critical RCE. No key signals conflict; the main gap is the absence of EPSS/KEV/POC data to confirm or rule out exploitation interest.

An attacker positioned as (or on-path to) a BGP peer of a QFX5240/5241/5250 switch configured with global-load-balancing and more than 128 ECMP next-hops sends crafted BGP routing updates that trigger the out-of-bounds write in rpd. The resulting rpd crash disrupts routing on the affected device, causing a denial of service. No public exploit identified at time of analysis; the adjacent attack vector and dependence on a specific configuration limit practical reach.