Juniper Junos OS EUVD-2026-101325

Exploitation requires that the target device be a Juniper MX Series or EX Series (Junos OS) or ACX Series (Junos OS Evolved) platform that supports and has draft-Rosen MVPN (multicast VPN) configured and active - the advisory explicitly scopes the flaw to platforms supporting draft Rosen MVPN, so devices without MVPN enabled are not affected. The attacker must occupy an adjacent network position (AV:A) able to deliver a crafted Rosen-MVPN protocol message into the rpd routing process; it cannot be triggered from an arbitrary remote/internet source. No authentication is required (PR:N) and no user interaction is needed (UI:N). Primary limiting factors: adjacency requirement and dependence on the non-universal draft-Rosen MVPN feature being deployed; impact is capped at information disclosure and multicast state manipulation rather than device takeover.

This is a medium-severity issue (vendor CVSS 4.0 base 5.3) that realistically ranks as a moderate, patch-in-normal-cycle priority rather than an emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N) shows the strongest mitigating factor is AV:A - the attacker must be logically adjacent (same L2 segment / directly connected link within the MVPN routing domain), not routable from the internet, which sharply narrows the viable attacker population to someone already inside the provider/enterprise network path. No privileges and no user interaction are required, and complexity is low, so any adjacent party can attempt it. Impact is bounded: only low confidentiality (heap memory disclosure) and low integrity (multicast join-state injection), with no availability impact and no scope change. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code was identified at time of analysis - so there is no signal of active or imminent exploitation; the risk is theoretical/latent. Signals are consistent (medium CVSS, no exploitation evidence) rather than conflicting. Note the input CVSS 4.0 string also carries AU:Y, R:A, V:C and RE:M supplemental/threat metrics, which indicate automatable-adjacent behavior but do not change the base severity; EPSS is absent and should be checked before deprioritizing entirely.

An attacker with a foothold on an adjacent link within the multicast VPN domain (e.g. a compromised PE/CE neighbor or a rogue device on the same segment) sends a malformed draft-Rosen MVPN message to a vulnerable rpd process on a Juniper MX, EX, or ACX device. The integer underflow causes the device to leak heap memory contents back to the attacker and to accept injected multicast join-state. No public exploit code was identified at time of analysis, and exploitation requires adjacent network positioning rather than remote internet access.