Juniper Junos OS CVE-2026-102044

Exploitation requires that the target run BGP-LS (BGP Link-State) and have an established, operator-configured BGP-LS peering session; the attacker must act as a configured BGP-LS peer and send a malicious BGP-LS update that reaches the rpd process. Limiting factors: devices without BGP-LS configured are not exposed, and the attacker must occupy or spoof an already-trusted, configured peer relationship (BGP sessions are typically point-to-point with known neighbors), which narrows the viable attacker set. Impact is confined to denial of service of the routing process; no confidentiality or integrity impact applies.

This is a credible operational-availability risk for networks that run BGP-LS, but not a 'drop everything' internet-facing emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 (High) and reflects a network-reachable, low-complexity trigger with high availability impact (VA:H) plus a lesser subsequent-system availability effect (SA:L). However, the description materially constrains the raw vector: the attacker must be 'a configured BGP-LS peer,' meaning exploitation requires an already-established, operator-configured BGP-LS peering relationship rather than arbitrary unauthenticated internet access. That gap between PR:N and the real-world 'configured peer' prerequisite should be noted - the flaw is remotely triggerable in protocol terms but gated by the trust/configuration boundary of BGP peering. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or available exploit code. CWE-617 (Reachable Assertion) is consistent with a deterministic crash/restart of the rpd routing daemon rather than code execution or data compromise (VC:N/VI:N). Net: a real priority for BGP-LS-enabled service-provider and large-enterprise edge/core routers because rpd disruption degrades routing, but lower urgency where BGP-LS is not configured or peers are tightly controlled and trusted.

An attacker who controls, spoofs, or compromises a device that is a configured BGP-LS peer of a vulnerable Junos/Junos OS Evolved router sends a specially crafted BGP-LS update. The update drives the rpd process into a reachable assertion failure, crashing or restarting the routing daemon and disrupting routing on the target. No public exploit code is identified at time of analysis, and the attack requires an established BGP-LS peering relationship rather than arbitrary network access.