Juniper Junos OS CVE-2026-102019

Exploitation requires that RIPv2 routing be actively configured and enabled on the target Junos OS or Junos Evolved device, since the malformed RIPv2 message must reach the rpd routing daemon's processing path; devices not running RIP are not exposed. The attacker must be network-adjacent (AV:A) - directly on the same link or broadcast domain as the target - rather than remote across the internet, which is the primary factor limiting realistic exploitation. No authentication (PR:N) and no user interaction (UI:N) are required once adjacency is achieved, and impact is limited to availability (routing disruption), with no confidentiality or integrity effect.

This is a moderate-risk availability issue, not a top-tier emergency. The vendor-provided CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes an adjacent, low-complexity, unauthenticated attack requiring no user interaction, but impact is confined to availability (VC:N/VI:N/VA:H, SA:L) - a denial-of-service on the routing protocol daemon (rpd), consistent with CWE-1284. The 7.1 score is meaningfully tempered by the AV:A constraint: the attacker must be on the same link/broadcast segment as the target, not anywhere on the internet, which sharply limits the realistic attacker population to those already inside the L2 adjacency (compromised neighbor device, malicious host on a shared segment, or an insider). No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active exploitation or available exploit code. The chief limiting factor not captured by CVSS is configuration dependence: RIPv2 must be actively configured on the device for the malformed message to reach the vulnerable code path, and RIP is not a default-enabled protocol in most modern Junos deployments. Net: a legitimate patching priority for operators running RIPv2 on exposed segments, but low urgency for the majority of Junos fleets that do not run RIP.

An attacker positioned on a network segment directly adjacent to a Junos OS or Junos Evolved device that has RIPv2 enabled crafts and sends a malformed RIPv2 message to the routing daemon. The improper quantity validation in rpd causes the process to crash or hang, disrupting routing and producing a denial-of-service condition. No authentication or user interaction is required, but the attacker must already hold a position on the adjacent link; no public exploit identified at time of analysis.