Junos OS CVE-2026-102026

Exploitation requires two specific conditions: (1) the RIB sharding feature must be explicitly enabled on the target, which is not a default configuration, and (2) the attacker must be an adjacent eBGP peer with an established BGP peering session to the device, then send a crafted BGP route update to trigger the rpd resource-lifecycle fault. Limiting factors: the non-default RIB-sharding requirement and the need for an existing eBGP peering relationship substantially narrow the exploitable population; devices without RIB sharding, or those peering only with trusted/controlled neighbors, are not realistically exposed. Impact is limited to denial of service (routing-daemon crash); there is no confidentiality or integrity impact.

This is a high-severity but condition-gated denial-of-service issue, not a code-execution or data-exposure flaw. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 and implies remote, unauthenticated, low-complexity exploitation with high availability impact (VA:H) plus minor subsequent-system impact (SA:L), consistent with the CWE-664 lifecycle/resource-management root cause and the pure-DoS nature (VC:N/VI:N). However, two signals temper the raw score. First, the description explicitly scopes the threat to an 'adjacent eBGP peer,' which conflicts with the vendor's AV:N (network) selection - an eBGP peer is normally a directly-connected, pre-configured trust relationship, so the realistic attack surface is narrower than AV:N suggests; verify adjacency assumptions against JSA112187. Second, exploitation requires the non-default 'RIB sharding' feature to be enabled, a target-side precondition the vendor's AT:N does not reflect. There is no EPSS score, no CISA KEV listing, and no public exploit in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a genuine availability priority for operators running RIB sharding who peer eBGP with untrusted or externally-reachable neighbors, but materially lower real-world risk for the majority of Junos deployments that do not enable RIB sharding or that peer only with trusted parties.

An attacker who controls or can impersonate a configured adjacent eBGP peer sends a malformed or specifically-crafted BGP route update to a Junos OS or Junos OS Evolved device that has RIB sharding enabled. The improper resource handling in the routing protocol daemon (rpd) causes the daemon to crash, disrupting routing on the device. No public proof-of-concept is identified in the available data.