Junos OS CVE-2026-101996

Exploitation requires the target Junos OS or Junos OS Evolved device to be explicitly configured for MC-LAG (Multi-Chassis Link Aggregation) with ICCP (Inter-Chassis Communication Protocol) enabled - devices without this high-availability redundancy feature are not affected. The attacker must be adjacent (AV:A): L2-adjacent or able to deliver traffic into the ICCP peer relationship, so this is not exploitable from arbitrary remote internet hosts. The attack is unauthenticated (PR:N) and requires no user interaction (UI:N), and the trigger is an inconsistent ICCP peer message that forces a reachable assertion in the l2ald daemon. Primary limiting factors: non-default MC-LAG/ICCP configuration and the required network adjacency to the peer link.

This is a genuine but conditional availability risk rather than a top-tier emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) scores 7.1 and indicates an adjacent, low-complexity, unauthenticated attack with high availability impact to the vulnerable system (VA:H) plus minor subsequent-system availability impact (SA:L), consistent with a reachable assertion (CWE-617) that crashes the l2ald daemon. Several mitigating signals pull real-world risk below the raw score: the attack vector is Adjacent (AV:A), not Network, so the attacker must have L2/ICCP-peer proximity rather than arbitrary internet reach; and the vulnerability only manifests on devices explicitly configured for MC-LAG/ICCP, a non-default high-availability feature. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this appears to be a vendor-reported (Juniper JSA112187) issue rather than an opportunistically exploited one. There is no confidentiality or integrity impact (VC:N/VI:N). Net assessment: a priority patch for carrier/enterprise operators running MC-LAG redundancy pairs, but low urgency for the majority of Junos deployments that do not run ICCP.

An attacker positioned on the same L2 segment as, or acting as an ICCP peer to, a Junos device running MC-LAG sends a crafted, inconsistent ICCP peer message. The l2ald daemon hits a reachable assertion and crashes, disrupting the multi-chassis link aggregation control plane and causing a denial of service. No proof-of-concept was provided and exploitation requires adjacency plus an MC-LAG/ICCP configuration, limiting the attacker population.