Junos OS EUVD-2026-101319

Exploitation requires ALL of the following: (1) the target runs an affected Junos OS or Junos OS Evolved release train; (2) both the routing-policy resolution-map feature AND policy event-tracing are configured/enabled - a non-default combination that does not exist in baseline configurations; and (3) the attacker is an already-configured, established BGP neighbor of the device (a peering/trust relationship must exist). The attack is then triggered by a single crafted BGP route update. Limiting factors that reduce real-world risk: the specific resolution-map plus event-tracing configuration is not present by default, and exploitation is confined to existing BGP peers rather than arbitrary Internet hosts, so a device without that configuration or without the attacker as a peer is not exposed.

The vendor CVSS 4.0 base score of 8.7 (High) is driven entirely by availability impact (VA:H, SA:L) with no confidentiality or integrity effect, consistent with a NULL pointer dereference DoS (CWE-476). The vector claims network, low-complexity, unauthenticated exploitation (AV:N/AC:L/AT:N/PR:N/UI:N), which on its face suggests high priority. However, this signal must be tempered: the description specifies exploitation is only possible when a non-default combination of features - routing-policy resolution-map AND policy event-tracing - is configured, and the trigger requires the attacker to already be a configured BGP neighbor, i.e. a pre-established peering/trust relationship. The vendor's AT:N (no attack requirement) appears optimistic given this explicit configuration dependency; AT:P would better reflect reality. No EPSS score, SSVC decision, or exploitation-probability data was supplied, and the vulnerability is NOT listed in CISA KEV and has no known public exploit. Net assessment: this is a genuine availability risk for carrier/enterprise networks running the specific affected Junos trains with that config, but the configured-peer prerequisite and non-default feature requirement make it targeted rather than mass-exploitable - not a drop-everything issue absent the vulnerable configuration. A patch is available, which should be the primary mitigation.

An attacker (or a misbehaving/compromised device) that is already an established, configured BGP neighbor of a vulnerable Junos OS or Junos OS Evolved router running with routing-policy resolution-map and policy event-tracing enabled sends a crafted BGP route update. The update triggers a NULL pointer dereference in the routing protocol daemon (rpd), crashing it and causing a denial of service. No public exploit code has been identified at the time of analysis.