Junos OS CVE-2026-102177

Exploitation requires the target Junos OS / Junos OS Evolved device to be explicitly configured with BOTH IS-IS link protection AND backup-selection - this is a non-default feature combination, so devices without these IS-IS features enabled are not affected. The attacker must also hold an adjacent network position (AV:A): same Layer 2 segment or IS-IS routing adjacency as the target, not remote internet access. Limiting factors: adjacency requirement confines exploitation to attackers already on the routing fabric, and the specific IS-IS configuration dependency means only a subset of deployed routers are vulnerable; no authentication is required (PR:N per the CVSS vector) and no user interaction is needed.

This is a moderate-priority availability flaw rather than a critical emergency. The CVSS 4.0 base score is 7.2 (HIGH), driven by low attack complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), and high availability impact to the vulnerable system (VA:H). The key mitigating signal is the attack vector: AV:A means the attacker must be adjacent (same L2 segment / routing adjacency), not reachable from across the internet, which sharply narrows the realistic attacker population to someone already on the protected routing fabric. Exploitation is further gated by a non-default configuration (IS-IS link protection AND backup-selection both enabled), so most deployments are not exposed. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation - consistent with a vendor-reported (Juniper) bug caught internally rather than found in the wild. The input CVSS 4.0 vector asserts VC:L/VI:L (some confidentiality and integrity impact), but the description characterizes the issue strictly as a denial of service from an out-of-bounds write (CWE-787); this is a mild conflict - the practical impact is a rpd crash/DoS, and the low C/I claims should be verified with the vendor advisory (JSA112187). Overall: a real but config-dependent, adjacency-limited DoS - patch on normal maintenance cadence, prioritizing devices with the vulnerable IS-IS features enabled.

An attacker with a foothold on the same link or routing adjacency as a Junos OS or Junos OS Evolved device sends crafted IS-IS protocol traffic to a router that has IS-IS link protection and backup-selection configured. The malformed input triggers an out-of-bounds write in the routing protocol daemon (rpd), crashing it and causing a denial of service (loss of routing). No authentication is required (PR:N) and complexity is low (AC:L), but the adjacent-only vector (AV:A) means the attacker must already be on the routing fabric; no public exploit code is known at time of analysis.