Junos OS CVE-2026-102054

Exploitation requires the target Junos OS / Junos OS Evolved device to be configured as a VXLAN tunnel endpoint (VTEP) with overlay-ping processing active, and the attacker must occupy the same Layer-2 adjacency (AV:A) to send VXLAN overlay-ping traffic to that local VTEP - it is not remotely reachable across routed/Internet paths. No authentication is required (PR:N) and no user interaction is needed (UI:N). The primary limiting factors are the adjacency requirement and the dependency on VXLAN overlay being deployed; devices not configured for VXLAN/VTEP are not exposed. Impact is confined to disclosure of stale PFE packet memory (low confidentiality), with no integrity or availability consequence.

This is a medium-severity information-disclosure flaw (CVSS 4.0 base 5.3, vendor-assigned) whose real-world priority is modest and bounded by its access requirements. The CVSS 4.0 vector reports an adjacent attack vector (AV:A), low complexity (AC:L), no privileges (PR:N) and no user interaction (UI:N), but only low confidentiality impact (VC:L) with no integrity or availability impact - consistent with leaking stale PFE packet memory rather than enabling code execution or takeover. No EPSS score was supplied in the input, the CVE is not on CISA KEV, and no public proof-of-concept is referenced, so all three exploitation-likelihood signals are either absent or negative: no public exploit identified at time of analysis. The SSVC/exploitation framing is therefore low-urgency - the dominant risk-limiting factor is AV:A, which requires the attacker to be on the same Layer-2 segment as a configured VXLAN VTEP, not reachable across the Internet. There are no conflicting signals (CVSS adjacency aligns with the description's 'adjacent attacker' and 'local VTEP' language); the main gap is the missing EPSS value, which prevents a quantitative exploitation-probability comparison. Overall this is a legitimate patch-in-normal-cycle item for VXLAN-deploying operators, not an emergency.

An attacker positioned on the same Layer-2 segment as a Junos device acting as a VXLAN tunnel endpoint sends crafted VXLAN overlay-ping traffic to the local VTEP. Because L2ALM mishandles a length-parameter inconsistency (CWE-130), the device returns stale packet-forwarding-engine memory contents, leaking fragments of previously processed traffic. No public exploit code is identified at time of analysis, and the attack requires adjacency rather than remote Internet access.