Juniper Junos OS CVE-2026-102032

Exploitation requires the target Junos OS / Junos OS Evolved device to have the static MAC-IP feature (an EVPN capability) actively configured - this is not a default setting, so devices without it are unaffected. The attacker must be adjacent, i.e. on the same Layer-2 segment/broadcast domain as the target (AV:A); the flaw is not exploitable from routed/remote networks. No authentication and no user interaction are required (PR:N/UI:N). The primary limiting factors are the non-default feature dependency and the L2 adjacency requirement, which together confine realistic exploitation to attackers with a foothold on the local switching fabric.

Signals point to a moderate, situational risk rather than a top-tier emergency. The CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N, VA:H) describes an unauthenticated, low-complexity denial of service, but the adjacent (AV:A) attack vector confines the attacker to the same Layer-2 segment/broadcast domain - this is not internet-remote and cannot be triggered from arbitrary networks. Impact is availability-only (VC:N/VI:N, VA:H with SA:L); there is no confidentiality or integrity exposure, consistent with the CWE-401 memory-leak root cause. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Critically, exploitation is gated on a non-default configuration (the static MAC-IP feature must be in use), which sharply narrows the real-world attack surface. Net: a legitimate patch priority for operators running EVPN static MAC-IP on exposed L2 segments, but a high-CVSS-but-conditional issue for everyone else. Note the SA:L (subsequent-system availability) metric is vendor-assigned and not fully explained by the description - verify blast radius with Juniper JSA112187 if it matters operationally.

An attacker positioned on the same Layer-2 broadcast domain as a Junos OS or Junos OS Evolved device that has the static MAC-IP feature enabled repeatedly sends crafted packets to the l2ald process. Each packet leaks memory that is never freed (CWE-401), gradually exhausting available memory until the process or device degrades or crashes, producing a denial of service. No public exploit code was identified in the provided data.