Junos OS CVE-2026-101962

The device must be configured for BGP EVPN with multicast (e.g., EVPN handling of IGMP/MLD / SMET multicast routes) and must have an active BGP session over which the crafted update is received, because the crash is triggered specifically when rpd attempts to readvertise a malformed EVPN multicast update. This means a plain Junos box without EVPN multicast is not exposed. The principal limiting factor is reachability into the EVPN BGP control plane: the attacker needs a peering relationship or on-path/injection capability for the malformed update to arrive and be readvertised - mitigated in environments that restrict BGP peers, use authenticated/filtered sessions, or do not run EVPN multicast. No user interaction is required, and per the vendor vector no authentication to the device itself is needed once the update can reach it.

This is a genuine but bounded operational risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) rates it 8.7 (High), driven entirely by availability impact (VA:H on the vulnerable system, SA:L on subsequent systems) with zero confidentiality or integrity impact - consistent with a pure denial-of-service crash of the routing protocol daemon (rpd), not code execution. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent exploitation: exploitation status is 'no public exploit identified at time of analysis.' The signals are consistent rather than conflicting (availability-only impact matches the CWE-130 length-handling crash and the DoS tag), but one nuance must be flagged: although the vector asserts PR:N/AV:N, the description requires that the malformed BGP EVPN multicast update be received and 'attempted to be readvertised,' which in practice presupposes an established BGP EVPN session and an EVPN multicast configuration - so true 'no-privilege remote' reach depends on an attacker being able to inject a crafted update into the EVPN BGP mesh (on-path, a malicious/compromised peer, or via propagation from upstream). Priority should be High for networks running EVPN multicast on affected Junos versions (patch promptly), but lower for deployments that do not use EVPN or that tightly control BGP peering.

An attacker able to introduce routes into a Junos BGP EVPN fabric - for example a compromised or malicious EVPN peer, or an on-path position in a provider/data-center fabric - sends a BGP EVPN multicast update with an inconsistent/malformed length field. When the receiving Junos or Junos OS Evolved device attempts to readvertise that update, rpd mishandles the length parameter and crashes, disrupting routing. No public exploit code is identified at this time, so exploitation would require the attacker to craft the malformed update independently.