Junos OS CVE-2026-102036

Exploitation requires the target to be running EVPN with a configured, established BGP peering session, and the attacker must control a device acting as one of those configured EVPN BGP peers - a crafted EVPN Type-2 (MAC/IP) route advertisement is the trigger. The limiting factors are significant: the device must have EVPN configured and operational, and the attacker must already hold a trusted peer position in the EVPN control plane (not arbitrary unauthenticated internet access despite the PR:N rating). Devices without EVPN configured, or deployments where all BGP peers are strictly controlled and trusted, are not realistically exposed.

This is a credible operational priority for networks running EVPN, though not a mass-exploitation threat. The Juniper-supplied CVSS 4.0 vector scores 8.7 (High) driven entirely by availability impact (VA:H, SA:L) with no confidentiality or integrity effect - consistent with a CWE-190 integer overflow in the l2ald (Layer 2 Address Learning Daemon) process causing a denial of service. The vector lists PR:N (no privileges) and AV:N (network), which would normally imply trivial remote exploitation; however, the description states the attacker must be a 'configured EVPN BGP peer,' meaning an established BGP/EVPN adjacency is a hard prerequisite. This is a meaningful tension: CVSS treats the attacker as unauthenticated, but in practice exploitation requires an already-trusted peering relationship, which substantially narrows the realistic attacker set to a compromised or malicious peer rather than any arbitrary internet host - verify exploitability assumptions against the Juniper advisory (JSA112187). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization; the 4.0 Exploit Maturity is 'X' (not defined). Net: treat as a prioritized patch for EVPN-enabled Junos/Junos OS Evolved fabrics where peer trust cannot be fully guaranteed, but it is not a drop-everything internet-facing emergency.

A malicious or compromised device that is an established EVPN BGP peer advertises specially crafted EVPN Type-2 (MAC/IP) routes to a target Junos or Junos OS Evolved device. The crafted route data triggers an integer overflow in the l2ald process, crashing it and disrupting Layer 2 address learning, resulting in denial of service. No public exploit code was identified in the provided data; exploitation requires an existing EVPN peering relationship, so this is limited to adjacent trusted peers rather than arbitrary remote hosts.