Junos OS EUVD-2026-101320

Exploitation requires the target to be running EVPN and to have an established EVPN peering session, because the malformed Type-3 (Inclusive Multicast Ethernet Tag) or Type-4 (Ethernet Segment) route must be received 'from a configured EVPN peer' and is triggered specifically during route re-advertisement processing in rpd. The key limiting factor is this control-plane trust relationship: the attacker must occupy or compromise a configured EVPN peer rather than being an arbitrary unauthenticated internet host, despite the PR:N rating. Devices not configured for EVPN are not affected. Impact is confined to availability (rpd crash / routing DoS); no confidentiality or integrity compromise occurs.

This is a genuine priority for networks running EVPN on Juniper gear, but with an important trust-boundary caveat. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) rates it 8.7 (High) with the impact concentrated entirely in availability (VA:H, with a secondary SA:L), which matches the stated denial-of-service effect on the rpd routing daemon. However, the description is explicit that the malformed EVPN Type-3/Type-4 route must be 'received from a configured EVPN peer' - so although CVSS scores it as PR:N/unauthenticated, real-world exploitation requires the attacker to already be (or to have compromised/spoofed) an established EVPN BGP peer, which is a significant mitigating trust relationship not reflected in the raw vector. EPSS is not provided, there is no CISA KEV listing, and no public POC is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: treat as a high-priority patch for EVPN-enabled Junos/Junos OS Evolved deployments (crashing rpd can disrupt all routing on a core device), but the peer-trust prerequisite makes opportunistic internet-wide exploitation unlikely relative to the headline score.

An attacker who controls or has compromised a device configured as an EVPN peer (or can inject into the EVPN control plane) sends a malformed EVPN Type-3 (Inclusive Multicast Ethernet Tag) or Type-4 (Ethernet Segment) route with inconsistent length fields. When the target Junos/Junos OS Evolved device processes and re-advertises the route, the length mismatch crashes the rpd routing protocol daemon, dropping routing adjacencies. No public exploit code has been identified at time of analysis.