Juniper Junos OS CVE-2026-102033

Exploitation requires the target to be configured for MC-LAG with ICCP (Inter-Chassis Control Protocol) active, since the trigger is a crafted ICCP MC-LAG message processed by l2ald - standalone devices without MC-LAG are not affected. The attacker must be adjacent (AV:A): positioned within the Layer-2 adjacency or on the ICCP peering path between the MC-LAG chassis, not reachable from arbitrary remote networks. Per the CVSS vector PR:N and UI:N, no authentication or user interaction is needed once adjacency is achieved. Limiting factors: non-default MC-LAG configuration requirement and the adjacency constraint sharply reduce the realistic attacker population; impact is availability-only (no data exposure or code execution).

This is a genuine but situational priority rather than a top-tier emergency. The CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N) confirms an adjacent, low-complexity, unauthenticated attack path with high availability impact (VA:H) and a low subsequent-system availability effect (SA:L), yielding a 7.1 'High' score with no confidentiality or integrity impact - purely a denial-of-service. The AV:A (adjacent) rather than AV:N (network) constraint is the single biggest risk limiter: an attacker must already be in the Layer-2 adjacency / ICCP peering path of the device, which materially narrows the threat population to insiders, compromised adjacent nodes, or attackers on the inter-chassis link. No EPSS score, CISA KEV listing, or public POC was supplied in the intelligence, so by the precision rules this is 'no public exploit identified at time of analysis'; combined with the vendor-only (Juniper) single reference, there is no evidence of active or widespread exploitation. No signals are directly conflicting, but note that exploitation is gated on MC-LAG/ICCP being configured, so the realistic exposed footprint is far smaller than the raw Junos install base. Prioritize patching on MC-LAG chassis-cluster deployments; deprioritize on standalone devices without MC-LAG.

An attacker positioned on the inter-chassis communication path of a Junos MC-LAG pair (for example via a compromised peer switch or access to the ICCP peer link) sends a malformed ICCP MC-LAG message that the l2ald daemon fails to validate for specified quantity. The improper validation (CWE-1284) crashes or hangs l2ald, disrupting Layer-2 learning and MC-LAG operation and causing a denial of service. No public exploit code was identified in the provided data, so this scenario is inferred from the description and CVSS metrics.