Juniper Junos OS CVE-2026-57019

Exploitation requires Layer-2 adjacency - the attacker must be in the same broadcast domain as the target MX router to deliver the crafted packet (AV:A), so it is not remotely routable across the internet. The affected system must also be processing MAP-T traffic OR non-IP traffic encapsulated in IP such as MPLS over GRE; routers not configured for these encapsulations do not enter the vulnerable PFE code path. No authentication and no user interaction are needed (PR:N/UI:N) and no special conditions beyond adjacency and the feature being in use. Limiting factors: required Layer-2 network position, dependence on the non-default MAP-T / IP-encapsulated-non-IP forwarding features, restriction to MX Series hardware, and automatic FPC recovery which bounds each hit to a transient (not permanent) outage.

The vendor CVSS 4.0 base score is 7.1 (High) with vector AV:A/AC:L/PR:N/UI:N and availability-only impact (VA:H, SA:L). The adjacent attack vector (AV:A) is the key limiter: the attacker must sit in the same broadcast domain / Layer-2 segment, which sharply narrows the threat population versus a network-routable (AV:N) bug, but AC:L and PR:N mean no authentication and no special timing once adjacency is achieved, and AU:Y indicates the attack is automatable. Impact is availability-only - no confidentiality or integrity loss - and Junos automatically resets and recovers the FPC (R:A), so this is a transient disruption rather than persistent compromise, though a sustained packet stream could repeatedly reset the FPC for a rolling outage. No EPSS score, KEV entry, or public POC is present in the provided data, so real-world exploitation risk is currently low-to-moderate and gated by network position. Signals are internally consistent: this is a legitimate availability priority for exposed MX edge devices but not a drop-everything internet-facing RCE.

An attacker with a foothold on a host or device in the same broadcast domain as an MX Series router (for example a compromised server on an access VLAN, or a rogue device on a peering segment) crafts a single packet in the affected MAP-T or MPLS-over-GRE format and sends it toward the router. The PFE miscomputes the packet size, raises an MQSS major error, and the FPC resets, dropping all traffic on that line card until it recovers; repeating the packet produces a sustained outage. No authentication is required and the attack is automatable, but no public POC is identified at time of analysis.