Junos OS CVE-2026-102067

Exploitation requires that L2 LSP support (Layer 2 label-switched path signaling via RSVP) is explicitly enabled on the Junos OS or Junos OS Evolved device - this is a non-default feature, so devices without L2 LSP configured are not affected. The attacker must also hold an adjacent network position (AV:A: same L2 link/segment as the rpd), which precludes remote internet-based exploitation. Within those constraints, no authentication is needed (PR:N, unauthenticated) and no user interaction is required (UI:N), and a single crafted RSVP packet suffices to cause the denial of service. The limiting factors are therefore the non-default L2 LSP configuration and the required network adjacency.

This is a genuine but bounded operational risk rather than an urgent internet-facing emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes an adjacent, low-complexity, unauthenticated attack with no user interaction, but the adjacency requirement (AV:A, not AV:N) means the attacker must be on the same L2 broadcast/link segment as the target rpd - a significant real-world limiter compared to a remotely reachable flaw. Impact is availability-only (VA:H, with a minor subsequent SA:L); there is no confidentiality or integrity exposure (VC:N/VI:N). No EPSS score, KEV listing, or POC was provided, and no public exploit identified at time of analysis, so exploitation is currently theoretical. The 7.1 'High' rating is driven almost entirely by the availability impact and ease of triggering once an attacker has adjacency and the L2 LSP feature is enabled; the non-default feature requirement and adjacency constraint meaningfully reduce the practical population of exploitable devices. Net: patch on a normal maintenance cadence (elevated for exposed/high-trust control planes) rather than emergency out-of-band. Note: exploitation is strictly conditional on L2 LSP (RSVP) being configured - verify this against your own device configuration before prioritizing.

An attacker positioned on a network segment adjacent to a Junos device configured with L2 LSP support sends a crafted RSVP packet to the routing protocol daemon (rpd). The malformed quantity field is improperly validated, crashing or hanging rpd and disrupting routing, which degrades or halts traffic forwarding. No authentication or user interaction is required, but the attacker must have adjacent (same-link) access and the target must have L2 LSP enabled; no public exploit is known.