Junos OS EUVD-2026-101321

The device must be running Junos OS or Junos OS Evolved in an affected version with BGP and the EVPN address family configured (typical of EVPN-VXLAN data center fabrics or EVPN-based L2/L3 VPN deployments) - EVPN is not a default-on configuration. The attacker must be able to deliver a BGP EVPN update message to rpd, which in practice requires an established BGP EVPN session (a configured peer or an on-path attacker on the peering path), even though the vendor CVSS rates it PR:N/AV:N. Limiting factors: no EVPN configuration means no exposure; reaching the BGP session typically requires peer or on-path positioning rather than arbitrary Internet access; impact is availability-only (control-plane DoS) with no data or integrity exposure.

This is a credible operational priority for networks running EVPN, but it is a single-dimension (availability-only) flaw, not a compromise risk. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remote, low-complexity, unauthenticated trigger with high availability impact on the vulnerable system (VA:H) and a minor cascading availability effect on connected systems (SA:L), yielding 8.7 (High); confidentiality and integrity impact are both None, so this cannot be used for data theft or code execution - only to crash the routing protocol daemon (rpd). No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so exploitation status is: no public exploit identified at time of analysis. One signal to verify: the CVSS rates this PR:N/AC:L, yet delivering a 'crafted BGP EVPN update message' realistically presupposes an established BGP EVPN session (a peer or on-path position), which materially narrows the attacker population versus a truly anonymous Internet attacker - verify the actual trigger surface with Juniper JSA112187. Net: patch promptly on EVPN-enabled Junos/Junos OS Evolved devices (control-plane DoS can disrupt routing broadly), but this is availability-only and likely requires peering context rather than being mass-exploitable.

An attacker positioned as a BGP EVPN peer (or on-path to an EVPN session) of a vulnerable Junos OS or Junos OS Evolved device sends a specially crafted BGP EVPN update message that fails input validation in rpd. The malformed update crashes or hangs the routing protocol daemon, causing a denial of service that disrupts routing on the device. No public exploit code is identified at time of analysis; the low attack complexity (AC:L) means a single crafted message is sufficient once the attacker can deliver updates.