Junos OS Evolved CVE-2026-101985

Exploitation requires the target PTX Series device to be running Junos OS Evolved with the IS-IS routing protocol configured and enabled, and the attacker must be positioned as an IS-IS peer - i.e., hold Layer 2 adjacency on a directly connected link or shared broadcast segment (reflected by CVSS AV:A, adjacent network). No authentication or user interaction is needed (PR:N/UI:N), but the adjacent-only requirement is the primary limiting factor: the attacker cannot reach rpd remotely across routed/Internet paths and must either be an untrusted device permitted to form an adjacency or already have access to a trusted network segment. Risk is therefore concentrated in deployments where IS-IS adjacencies can be formed with less-trusted or externally accessible interfaces; impact is availability-only (A:H) with no confidentiality or integrity effect.

This is a medium-severity (CVSS 6.5) availability-only denial-of-service flaw whose real-world risk is tightly bounded by its attack vector rather than its severity label. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms exploitation requires adjacent-network position - consistent with IS-IS being a link-local routing protocol operating between directly connected peers - not remote Internet reachability, which substantially narrows the attacker population to someone already on the same L2 segment or an established IS-IS adjacency. PR:N (unauthenticated) and AC:L raise concern once that adjacency exists, but the C:N/I:N scope means impact is limited to disruption of the routing daemon (rpd), with no data compromise. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or probable near-term exploitation; the signals are internally consistent (vendor-reported, adjacent vector, availability-only) with no conflicts. Net: a legitimate patch priority for exposed service-provider core routers running IS-IS, but not an emergency compared to remote unauthenticated RCE - prioritize based on whether untrusted devices can form IS-IS adjacencies.

An attacker with Layer 2 adjacency to a PTX Series router running Junos OS Evolved establishes or abuses an IS-IS peering relationship and sends a crafted IS-IS protocol message containing an improperly validated quantity field. The routing protocol daemon (rpd) mishandles the input and crashes or hangs, disrupting routing and causing a denial of service. No public exploit code is identified at time of analysis, and the attacker needs adjacent-network position rather than remote Internet access.