Junos OS EUVD-2026-101315

Exploitation requires the target running Junos OS or Junos EVO to be explicitly configured with SRv6 EVPN multihoming - this is a non-default, feature-specific deployment, not a stock configuration. The attacker must also be a BGP EVPN neighbor (an established peering/trust relationship with the device), so exploitation is limited to parties within or able to reach the EVPN peering domain rather than arbitrary remote hosts. Affected version trains include Junos OS 25.2/25.4/26.2 and Junos OS Evolved 23.4X100/25.2/25.2X100/25.4/25.4X300/26.2 below the fixed service releases; devices not running SRv6 EVPN multihoming or already on patched releases are not exploitable. Impact is limited to denial of service (rpd crash); there is no confidentiality or integrity impact.

This is a credible but bounded availability risk, best read as a high-CVSS flaw whose real-world exploitability is gated by configuration. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with VA:H and SA:L yields 8.7 (High) and reflects a pure availability impact (VC:N/VI:N) - there is no confidentiality or integrity exposure, only an rpd crash. No EPSS score, KEV listing, or POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 8.7 is therefore theoretical severity, not observed threat. The decisive mitigating signal is that exploitation requires SRv6 EVPN multihoming to be explicitly configured AND the attacker to be an established BGP EVPN neighbor - a trust relationship, not an arbitrary internet host - which sharply narrows the realistic attack surface despite the PR:N rating. Note a tension worth verifying: CVSS scores this PR:N (unauthenticated) and AV:N (network), yet the description implies the attacker must already be a peering BGP EVPN neighbor, which is effectively a privileged trust position; the PR:N is defensible under CVSS convention for routing-protocol peers but overstates ease of access for operators who do not peer with untrusted parties. Priority is moderate-to-high for carriers/enterprises actually running SRv6 EVPN multihoming on affected Junos builds, and low for everyone else.

An attacker who controls or compromises a device in a BGP EVPN peering relationship with an affected Junos OS / Junos EVO router sends crafted EVPN route updates that trigger the incorrect calculation (CWE-682) in rpd on a device configured for SRv6 EVPN multihoming. The resulting rpd crash drops the routing control plane, disrupting traffic across the device and potentially its multihomed segment. No public proof-of-concept was provided, and exploitation depends on both the specific SRv6 EVPN multihoming configuration and an existing EVPN neighbor adjacency.