Juniper Junos OS CVE-2026-102180

Exploitation requires two specific conditions, both drawn from the description: (1) the attacker must have access to a configured BGP peering session with the target (an established peer relationship, not arbitrary remote access), and (2) the target must have an active BGP RIB streaming telemetry subscription when the crafted BGP route attribute is processed - this is the triggering condition and is not a default state. Additional limiting factors: only Junos OS/Junos OS Evolved versions 22.1R1 / 22.1R1-EVO and later are affected (earlier releases are not vulnerable), and impact is limited to denial of service (rpd crash) with no confidentiality or integrity effect. The BGP-peer prerequisite and non-default telemetry subscription together significantly constrain the realistic attacker population.

This is a legitimate but conditional availability risk rather than a top-tier emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 and models a pure availability impact (VA:H, SA:L; VC:N/VI:N) - consistent with a denial-of-service crash of the rpd routing daemon, not code execution or data compromise. The PR:N rating reflects CVSS convention (a BGP peer is treated as unauthenticated to the device), but in practice the attacker must occupy a configured BGP peering relationship, which is a meaningful trust/adjacency barrier that narrows the realistic attacker set to existing or hijacked peers. The vendor's AC:L/AT:N is arguably optimistic: the description states the crash only occurs 'while a BGP RIB streaming telemetry subscription is active,' a non-default operational condition that materially lowers real-world exploitability - I would independently rate this AC:H. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or public exploit code. Net: a patch-soon, not drop-everything, issue - high CVSS driven by network vector and high availability impact, but gated behind both a BGP peering foothold and an enabled telemetry subscription.

An attacker who controls or has compromised a device holding an established BGP peering session with a vulnerable Junos router sends a crafted BGP route attribute. If the target has an active BGP RIB streaming telemetry subscription, processing the attribute triggers a stack-based buffer overflow in rpd, crashing the routing daemon and disrupting routing (denial of service). No public exploit code was identified in the provided data.