Junos OS EUVD-2026-101311

Exploitation requires an adjacent-network (AV:A) position - the attacker must be on the same L2 broadcast domain or a directly connected link to the target - and the device must be processing MPLS LSP-ping (MPLS OAM echo-request) traffic reaching the rpd, implying MPLS is deployed and enabled. No authentication (PR:N) and no user interaction (UI:N) are needed, and default-configuration devices running MPLS are affected across the listed Junos OS and Junos OS Evolved trains. The primary limiting factor is the adjacency requirement: the flaw is not remotely reachable across routed/Internet paths, so blast radius is confined to attackers with local network reach, and impact is limited to availability (routing daemon crash) with no data exposure or modification.

This is a moderate-priority availability vulnerability, not a critical compromise. The supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L, base 7.1) is internally consistent with the description: an unauthenticated attacker with an adjacent-network position can crash the routing protocol daemon (rpd), yielding a denial of service with no confidentiality or integrity impact. The low attack complexity and lack of required privileges or user interaction make exploitation technically easy FOR an attacker who already holds adjacent access, but the AV:A constraint - not AV:N - is the dominant limiting factor and sharply narrows the realistic threat population to attackers on the same L2 segment or a directly connected link. No EPSS score, SSVC decision, KEV listing, or POC indicator was provided in the input, so exploitation likelihood cannot be quantified; there is no public exploit identified at time of analysis and no evidence of active exploitation. SA:L signals a minor spillover effect on connected systems (e.g., routing adjacencies dropping), consistent with an rpd crash propagating control-plane disruption. Net: a legitimate patch-worthy DoS against routing infrastructure, but weighted well below network-reachable RCE-class issues.

An attacker positioned on an adjacent network segment or directly connected link to a vulnerable Junos OS / Junos OS Evolved device sends a specifically malformed MPLS LSP-ping (echo request) packet to the target. The rpd daemon mishandles the packet (CWE-688, function call with an incorrect variable/reference argument) and crashes, disrupting routing and causing a denial of service. No public exploit code was identified at time of analysis, and no authentication or user interaction is required.