Junos OS CVE-2026-101961

Two concrete preconditions gate exploitation: (1) a nexthop-ecmp qualifier must be attached to a BGP import policy - a non-default routing-policy configuration that must be explicitly deployed; and (2) the attacker must be a configured eBGP peer of the target, i.e. an established external BGP neighbor relationship must already exist. Limiting factors: devices without the nexthop-ecmp import-policy configuration are not exploitable regardless of version, and the attacker cannot be an arbitrary unauthenticated Internet host - they must sit in an accepted BGP peering session. Only affected Junos OS and Junos OS Evolved versions listed in EUVD are vulnerable; upgrading to the fixed service releases removes the exposure. Impact is limited to routing-daemon availability (DoS); there is no confidentiality or integrity effect.

Multiple signals must be weighed carefully here. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L, 8.7 High) presents this as a network-reachable, low-complexity, unauthenticated availability attack. However, the PR:N/AT:N framing overstates real-world reachability: the description makes clear the attacker must be an already-configured eBGP peer (a trust/peering relationship, not an anonymous Internet attacker) AND the target must have a nexthop-ecmp qualifier attached to a BGP import policy - a non-default configuration. These two preconditions materially narrow the exploitable population and argue for an attack-requirement/complexity penalty the vendor vector omits. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: this is a genuine availability threat to service-provider and enterprise edge routers running the specific ECMP matcher configuration - a crashed rpd disrupts routing - but it is not an indiscriminate, spray-and-pray issue. It is a priority for operators who both run affected Junos/Junos Evolved versions and use nexthop-ecmp import policies with external BGP peers; for everyone else the real-world risk is considerably lower than the 8.7 implies. Impact is availability-only (VC:N/VI:N), so there is no data exposure or code execution.

An attacker who controls or has compromised a device in an eBGP peering relationship with a vulnerable Junos/Junos OS Evolved router sends a specifically crafted BGP packet. Because the target has a nexthop-ecmp qualifier bound to a BGP import policy, processing the packet triggers a NULL pointer dereference (CWE-476) in the routing daemon (rpd), crashing it and causing a routing denial of service. No public exploit code was identified in the provided data, and exploitation requires the attacker to already be an accepted BGP neighbor.