Juniper Junos OS CVE-2026-101994

Exploitation requires that MC-LAG be configured and operational with ICCP (Inter-Chassis Control Protocol) between chassis, and that the attacker can control or impersonate a configured ICCP peer - meaning the attacker must already occupy or spoof a trusted position on the inter-chassis control link (AV:A, adjacent). This is not remotely exploitable from the internet against a default configuration: devices without MC-LAG/ICCP configured are not exposed. The principal limiting factors are the non-default MC-LAG deployment mode and the need for a trusted ICCP peer position; impact is limited to heap memory disclosure (C:L) and denial of service of the l2ald daemon (A:H), with no integrity impact.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, base 7.1) describes an adjacent-network, low-complexity, unauthenticated attack with high availability impact and partial confidentiality (heap) disclosure. The 'unauthenticated' (PR:N) rating is technically accurate per the vector but materially softened by the exploitation prerequisite: the attacker must be able to control or impersonate a legitimately configured MC-LAG ICCP peer, which is an adjacent (AV:A) rather than remote-internet-facing position. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so by the precision rules this is 'no public exploit identified at time of analysis.' Net assessment: a genuine but situational issue - high CVSS driven by A:H, but real-world exposure is gated by an uncommon privileged network position (ICCP peer on the inter-chassis control link) rather than broad remote reachability. Priority is elevated for operators running MC-LAG topologies and low for everyone else. No signals conflict; the main caveat is that PR:N overstates ease of access given the ICCP-peer prerequisite - the adjacency and peer-impersonation requirement is the true limiting factor.

An attacker positioned on the inter-chassis control link who can impersonate or has compromised a configured MC-LAG ICCP peer sends a malformed ICCP message with an inconsistent length parameter to the target's l2ald daemon. The length mishandling causes the daemon to either leak adjacent process heap memory back to the attacker or crash, disrupting layer-2 MC-LAG operation. No public exploit code is identified at time of analysis.