Junos OS CVE-2026-102178

Exploitation requires that the target have a BGP flowspec peering session explicitly configured with the attacker-controlled peer, AND that BGP update-threading be enabled on the device - the overflow is triggered specifically by flowspec route re-advertisement under these conditions. Key limiting factors: the attacker must already be a configured (trusted) BGP flowspec neighbor, not an arbitrary remote host; update-threading is a non-default operational setting, so devices without it enabled or without flowspec peering are not exposed. Affected releases span numerous Junos OS and Junos OS Evolved trains (fixed in builds such as 23.2R2-S7.7, 23.4R2-S8.13, 24.4R2-S5, 25.4R1-S3, 26.2R1-S2 and the corresponding -EVO builds per EUVD).

This is a genuinely high-priority vulnerability, though its true exploitability is more constrained than the 9.3 CRITICAL score alone suggests. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, unauthenticated flaw yielding full confidentiality, integrity and availability impact to the routing engine - consistent with the description's 'routing-engine compromise or routing-daemon denial of service.' However, PR:N overstates openness: the description requires the attacker to be a 'configured BGP flowspec peer,' i.e. an already-established, operator-configured BGP neighbor, which is a trust relationship rather than an anonymous Internet attacker. The vector also encodes AU:Y (automatable) and V:C (concentrated value), which raise concern, but the real gating factor is that BGP update-threading must be enabled - a non-default operational choice. No EPSS score, POC, or CISA KEV entry is present in the provided data, so there is no evidence of active or at-scale exploitation. Net assessment: a serious flaw in widely deployed carrier/enterprise routing gear with a vendor patch available, but realistic exploitation is limited to adversaries who already hold a BGP flowspec peering session with the target and only where update-threading is enabled - more a targeted/insider-adjacent trust-boundary risk than a mass-exploitable Internet-facing bug. CVSS PR:N vs the description's 'configured peer' prerequisite is a notable tension - treat the attacker as a trusted peer, not an anonymous remote party.

An attacker who controls or compromises a device holding a configured BGP flowspec peering session with a vulnerable Junos router crafts and re-advertises a malicious flowspec route. On a target with BGP update-threading enabled, processing this re-advertisement triggers a stack-based buffer overflow in the routing daemon, crashing it (DoS) or potentially compromising the routing engine. No public exploit code is identified at time of analysis, and exploitation requires an established flowspec peering relationship rather than anonymous network access.