Junos OS CVE-2026-101993

Exploitation requires that the target run VPLS with 'automatic site-ID negotiation' enabled - this specific feature is the triggering precondition named in the description, and without it the vulnerable code path is not reachable. The attacker must additionally be an adjacent eBGP peer (AV:A), meaning an established external BGP peering session with the victim router is required, limiting exploitation to directly peered neighbors rather than arbitrary remote hosts. Limiting factors: non-default VPLS auto site-ID negotiation configuration, the need for an existing eBGP adjacency, and impact confined to availability (rpd crash/DoS) with no data exposure or code execution.

This is a moderate-priority availability issue, not a drop-everything emergency. The CVSS 4.0 base score of 7.1 is driven entirely by availability impact (VA:H, SA:L) with no confidentiality or integrity effect, and critically the attack vector is Adjacent (AV:A), not Network - the attacker must be a directly configured eBGP peer, which sharply limits the attacker population to entities already in a BGP peering relationship. No EPSS score, KEV listing, or POC was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Although the Juniper CVSS vector uses PR:N (no system privileges required), real-world exploitation requires an established eBGP adjacency, which is itself a configuration/trust relationship - this is a meaningful mitigating factor the raw PR:N metric understates. SSVC-style framing: exploitation is not observed, technical impact is partial (daemon crash/DoS of rpd, not total system compromise), and automatability is low because the attacker needs peering adjacency plus a non-default feature. Net: a legitimate patch-management priority for operators running VPLS with automatic site-ID negotiation, but low real-world risk for the broad Junos install base that does not enable that feature.

An attacker who controls (or has compromised) a device configured as an adjacent eBGP peer of a vulnerable Junos OS / Junos OS Evolved router sends a crafted VPLS signaling update. When automatic site-ID negotiation is enabled, the update triggers a reachable assertion in the routing protocol daemon (rpd), crashing the daemon and causing a denial of service. No public exploit code was identified at time of analysis; exploitation requires an existing eBGP peering relationship and the non-default negotiation feature.