Junos OS CVE-2026-102022

Exploitation requires that the target Junos OS or Junos OS Evolved device be configured with BGP-LS and have an established BGP-LS peering session, and that the attacker occupy or control one of those configured BGP-LS peers (a pre-existing, operator-provisioned trust relationship) from which to send a crafted BGP-LS Link NLRI advertisement. Devices without BGP-LS configured are not affected. The principal limiting factor is this configured-peer prerequisite: although CVSS marks PR:N (no authentication in the protocol sense), the attacker cannot simply reach the service from anywhere - they must be positioned within an accepted BGP-LS adjacency. Impact is limited to a denial of service (rpd crash); no code execution, data disclosure, or integrity impact occurs.

This is a credible operational-risk denial-of-service issue rather than a code-execution or data-breach threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) rates it 8.7 (High) and reflects a network-reachable, low-complexity attack with no user interaction, with impact confined to availability (VA:H, plus SA:L on a subsequent system reflecting routing-plane disruption). There is no confidentiality or integrity impact (VC:N/VI:N). The headline PR:N is technically accurate but misleading on its own: the description explicitly limits exploitation to 'an attacker with access to a configured BGP-LS peer,' meaning the attacker must already occupy a trusted BGP-LS adjacency that the operator deliberately configured. That trust-relationship prerequisite substantially narrows the real attacker population versus a truly open internet-facing service. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no signal of active or probable exploitation - exploitation status is 'no public exploit identified at time of analysis.' Net: real priority for Junos operators running BGP-LS (patch promptly), but not an indiscriminately exploitable, mass-scannable flaw; the configured-peer requirement and DoS-only impact temper the raw 8.7.

An attacker who controls or has compromised a device configured as a BGP-LS peer of a Junos/Junos Evolved router sends a crafted BGP-LS Link NLRI advertisement. The malformed advertisement triggers a reachable assertion (CWE-617) in the routing protocol daemon (rpd), crashing it and disrupting routing on the target. No public exploit code was identified in the provided intelligence; exploitation requires an established BGP-LS peering relationship.