Juniper Junos OS CVE-2026-102066

Exploitation requires that RSVP be explicitly enabled on the interface receiving the attacker's traffic - this is a non-default configuration tied to MPLS traffic-engineering/RSVP signaling deployments, so routers without RSVP configured are not exposed. The attacker must also have adjacent (Layer-2/directly-reachable) access to that interface (CVSS AV:A), limiting exploitation to attackers on a connected link, peering segment, or an already-compromised neighboring device rather than arbitrary remote internet hosts. No authentication and no user interaction are needed (PR:N/UI:N), and impact is limited to denial of service (availability only); there is no confidentiality or integrity exposure.

This is a moderate, real-but-conditional availability risk rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) shows an adjacent, low-complexity, unauthenticated path with no required attack prerequisites, and the only impact is availability (VA:H plus SA:L subsequent-system availability) - consistent with a routing-daemon (rpd) crash/DoS and no confidentiality or integrity loss. The score of 7.1 is driven entirely by the ease of triggering and the high availability impact, not by code execution. Three signals temper the raw score: (1) the vector is AV:A (adjacent/Layer-2 reachable), not AV:N, so an attacker needs network adjacency to the vulnerable interface rather than arbitrary internet access; (2) exploitation is gated on RSVP being enabled on the receiving interface, which is a non-default, MPLS/traffic-engineering-specific configuration; and (3) there is no EPSS score, no CISA KEV listing, and no public POC in the provided data, indicating no evidence of real-world exploitation. Net: this is a legitimate patch-priority item for operators who run RSVP/MPLS on Junos, but it is not a drop-everything issue for the general Junos population. No conflicting signals were found, but note that EPSS/POC data is simply absent rather than confirmed-negative.

An attacker with Layer-2 adjacency to a Junos or Junos OS Evolved router (for example, a compromised device or malicious host on a directly connected link or peering segment) sends a specially malformed RSVP packet to an interface where RSVP is enabled. Improper validation of a specified quantity in the packet causes the routing protocol daemon (rpd) to fail, disrupting routing and causing a denial of service. No public exploit code is identified at the time of analysis, and no authentication is required.