Juniper Junos OS CVE-2026-102035

Exploitation requires that the target Junos OS or Junos OS Evolved device be configured for MC-LAG with IRB MAC synchronization enabled - this is NOT a default configuration, which substantially narrows the exposed population. The attacker must also occupy an adjacent network position capable of delivering an ICCP (Inter-Chassis Control Protocol) peer message, i.e. on or able to reach the inter-chassis control link between MC-LAG peers, rather than arbitrary remote Internet access. No authentication is required per the vector (PR:N) and no user interaction is needed (UI:N); the primary limiting factors are the adjacency requirement (AV:A) and the non-default MC-LAG IRB feature dependency.

This is a genuine but conditional denial-of-service issue, not a critical remote-code-execution emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) signals low-complexity, unauthenticated exploitation, but only from an ADJACENT position (AV:A) and only against availability (VA:H; VC:N/VI:N - no confidentiality or integrity impact), consistent with the CWE-617 Reachable Assertion crashing the l2ald process. The vendor base score of 7.1 is elevated largely by supplemental metrics; the pure base impact is a single-process DoS. Critically, exploitation is gated by a non-default feature state - MC-LAG with IRB MAC synchronization must be enabled - which the raw CVSS vector does not capture (AT:N arguably understates this). No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active or at-scale exploitation; the signals are not conflicting so much as sparse. Net: a real priority only for operators running MC-LAG IRB in redundant chassis deployments, where an on-path/adjacent attacker on the ICCP channel could disrupt service; for everyone else the practical risk is low.

An attacker with adjacent access to the inter-chassis control channel between MC-LAG peers sends a crafted ICCP peer message to a Junos device that has MC-LAG IRB MAC synchronization enabled. The malformed message triggers a reachable assertion in the l2ald process, crashing it and causing a denial of service. No public exploit was identified in the provided data, and success depends on the attacker already being positioned on the ICCP/adjacent network segment.