Juniper Junos OS CVE-2026-102013

Exploitation requires network reachability to the chassis-internal (control-plane fabric) network of the affected device and the ability to deliver a crafted network message to the na-grpcd process - this internal fabric is not normally exposed to external, WAN, or standard management networks, which is the primary factor limiting real-world exploitation. The affected products are Junos OS and Junos OS Evolved across numerous release trains (e.g., versions before 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2 and corresponding -EVO builds). The description states the attacker is unauthenticated, but the vendor CVSS vector lists PR:H, so account-level authentication requirements are not consistently confirmed; the concrete gating condition is privileged access to the internal chassis network rather than a specific feature toggle.

This is a moderate-severity, low-urgency availability issue rather than a high-priority emergency. The CVSS 4.0 base score is 6.7 (Medium) with a local attack vector (AV:L) and low complexity (AC:L), and the only impact is availability (VA:H / SA:L) - a denial of service against the na-grpcd process, with no confidentiality or integrity impact. The most important mitigating signal is the attack vector: exploitation requires access to the chassis-internal network, an internal control-plane fabric that is not normally reachable from external or even standard management networks, which sharply limits the realistic attacker population. There is a notable CONFLICT in the source data: the description explicitly calls the attacker 'unauthenticated,' yet the vendor CVSS vector sets PR:H (high privileges required) - these two signals disagree, and the discrepancy most likely reflects that 'privilege' here is modeled as the privileged network position needed to reach the chassis-internal fabric rather than an account credential; defenders should verify intent with Juniper (JSA112187). No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active exploitation or available exploit code. Net: real but low-probability risk, appropriate for scheduled patching rather than emergency response.

An attacker who has already gained a foothold on the chassis-internal control-plane network (for example via a compromised line card, internal fabric access, or supply-chain/insider position) sends a crafted network message to the na-grpcd process. The malformed message triggers a NULL pointer dereference (CWE-476) that crashes the daemon, producing a denial of service on the affected Junos OS or Junos OS Evolved device. No public exploit code was identified at time of analysis, and the chassis-internal access requirement makes opportunistic internet-based exploitation implausible.