Juniper Junos OS CVE-2026-102000

Exploitation requires that LDP (Label Distribution Protocol, used for MPLS label signaling) be configured and active on the target Junos OS / Junos OS Evolved device, since the crash is triggered by LDP control traffic processed by the rpd daemon. The attacker must have adjacent network access (AV:A) - i.e., be on the same L2 segment or a directly connected link able to reach the device with LDP traffic - and no authentication is required (PR:N) nor user interaction (UI:N). Limiting factors: devices not running LDP/MPLS are not exposed; the adjacency requirement excludes arbitrary internet-based attackers and confines the realistic threat to internal networks, shared exchange fabrics, or compromised adjacent peers. Impact is limited to availability (routing/forwarding disruption) with no data exposure or modification.

This is a moderate-severity, single-impact availability vulnerability (CVSS 4.0 base 7.1) with no confidentiality or integrity impact (VC:N/VI:N). The provided CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VA:H/SA:L) is internally consistent with the description: an adjacent (same L2 segment / directly connected link) unauthenticated attacker can crash the rpd routing daemon via malformed LDP control traffic, producing a denial of service with a low-level subsequent-system availability effect (SA:L, reflecting broader routing disruption). The key risk-limiting factor is AV:A - this is NOT remotely exploitable across the internet; the attacker must be on an adjacent network/link that is actually running LDP, which materially narrows the threat population to on-path or internal adversaries. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no current evidence of active exploitation or widespread weaponization; this appears to be a vendor-disclosed (Juniper-reported) issue rather than an in-the-wild threat. Net: a legitimate patch-worthy bug for MPLS/LDP-enabled Juniper routers, but it is an availability-only, adjacency-constrained DoS rather than a critical remote-code-execution emergency. Prioritize on devices where LDP is configured on untrusted or shared segments; deprioritize where LDP is absent or restricted to trusted peers.

An attacker positioned on a network segment adjacent to a vulnerable Junos OS or Junos EVO router (e.g., a compromised peer, a rogue device on a shared link, or an internal attacker on an LDP-enabled network) sends specially crafted LDP control packets. The malformed traffic triggers a reachable assertion in the rpd process, causing it to crash and disrupting routing/forwarding on the device. No public exploit code was identified at time of analysis, and exploitation requires no authentication but does require LDP to be running and adjacent network positioning.