EUVD-2026-101326
GHSA-75wv-7fq3-rpgq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent network position on PIM segment
-
DeliveryCraft malformed PIMv6 Hello message
-
ExploitSend to IPv6-enabled PIM interface
-
ExecutionTrigger input-validation failure in rpd
-
ImpactCrash routing daemon (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires that PIM (Protocol Independent Multicast) be configured AND that the receiving interface be IPv6-enabled - routers without IPv6 PIM configured are not affected. The attacker must be network-adjacent (AV:A): able to deliver the malformed PIM Hello onto the same link/segment as the target interface, so the flaw is not exploitable from arbitrary remote networks. No authentication (PR:N) and no user interaction (UI:N) are needed once adjacency is achieved. Limiting factors: dependence on a non-default protocol/address-family combination (IPv6 PIM) and the L2 adjacency requirement substantially narrow the exposed population. |
| Impact | This is a genuine but bounded operational risk, best characterized as a moderate-severity availability issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) confirms an unauthenticated, low-complexity attack, but AV:A means the attacker must be network-adjacent (same L2 segment / link), which is a meaningful barrier compared to a fully remote (AV:N) flaw. Impact is confined to availability (VA:H, with SA:L subsequent-system availability) - there is no confidentiality or integrity exposure, consistent with an rpd-crash denial of service. No EPSS score, KEV listing, or POC was provided in the input, so exploitation status is: no public exploit identified at time of analysis. The signals are internally consistent - nothing conflicts - but note the vector's adjacency requirement tempers the 7.1 score; this is a prioritized patch for operators running IPv6 PIM on exposed segments, not a drop-everything internet-facing threat. EPSS and real-world exploitation data are absent and should be checked against vendor/CISA sources before final triage. |
| Exploit ScenarioDerived | An attacker positioned on a network segment adjacent to a Junos or Junos OS Evolved router (for example a compromised host or rogue device on the same link) sends a malformed PIM Hello packet to an IPv6-enabled PIM interface. The routing protocol daemon (rpd) fails to validate the input and crashes, disrupting routing and causing a denial of service. No public exploit code is identified at time of analysis, and the attack requires no authentication or user interaction once adjacency is achieved. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Malformed PIM Hello messages can crash the rpd process in Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service on IPv6-enabled PIM interfaces. This improper input validation flaw (CWE-20) is exploitable by an unauthenticated adjacent attacker (AV:A) without user interaction, but requires PIM to be configured and the target interface to be IPv6-enabled. No public exploit code or active exploitation is known; the CVSS 4.0 base score is 7.1, and independent assessment classifies this as a moderate-severity availability issue with a bounded exposed population.
RemediationAI
No vendor-released patch version is identified in the input data; however, the vendor advisory JSA112187 at https://supportportal.juniper.net/JSA112187 should be consulted for available fixes and updated version information. As a compensating control, disable PIM on IPv6-enabled interfaces where multicast routing is not required - this removes the attack vector but may disrupt legitimate IPv6 multicast traffic. If IPv6 PIM is necessary, restrict L2 adjacency by applying infrastructure ACLs (iACLs) to block PIM Hello messages (IP protocol 103) from untrusted segments, though this may interfere with legitimate PIM neighbor formation and require careful tuning. Additionally, consider isolating routing plane traffic and monitoring for unexpected rpd restarts. Apply vendor workarounds as documented in the advisory.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the rpd (routing protocol daemon) process of Juniper Networks Junos OS and Junos OS Evolved, as indicated by CPE entries cpe:2.3:a:juniper_networks:junos_os:*:*:*:*:*:*:*:* and cpe:2.3:a:juniper_networks:junos_os_evolved:*:*:*:*:*:*:*:*. PIM (Protocol Independent Multicast) is used for multicast routing; PIM Hello messages are exchanged between adjacent routers to establish and maintain neighbor relationships. The flaw is classified as CWE-20 (Improper Input Validation), meaning the rpd process fails to properly validate a malformed PIM Hello message received on an IPv6-enabled PIM interface, leading to a crash or restart of the daemon. Exploitation requires L2 adjacency (AV:A) and that both PIM and IPv6 be configured on the receiving interface; routers without IPv6 PIM are not affected. No authentication (PR:N) or user interaction (UI:N) is needed once adjacency is achieved. The crash of rpd can cause routing instability and a denial of service for the affected device.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M
Adjacent attacker on the PIM link (AV:A), no auth or interaction needed (PR:N/UI:N), and an rpd crash yields availability-only impact (A:H; C/I:N).
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
4DescriptionCVE.org
An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a malformed PIM Hello message received on an IPv6-enabled PIM interface.
Executive ViewAI
A malformed routing-protocol message can crash the routing control process on Juniper Networks Junos OS and Junos OS Evolved devices, disrupting IPv6 multicast routing wherever PIM is enabled on IPv6 interfaces. Because the attack comes from an adjacent network position without authentication or user interaction, any organization with Juniper routing platforms in shared or untrusted network segments - data centers, branch aggregation, or service provider edges - should treat this as a resilience risk to network availability. No vendor patch is available today, so leadership exposure is driven by how widely PIM over IPv6 is deployed and how well the network tolerates a routing-process restart.
No vendor-released patch identified at time of analysis. Interim mitigations: disable PIM on IPv6-enabled interfaces where multicast routing is not required; disable IPv6 on interfaces that do not need it; restrict adjacency to PIM-enabled segments via Layer 2 segmentation and interface firewall filters that permit PIM only from authorized neighbors; monitor and alert on rpd process restarts and anomalous PIM Hello traffic; and ensure routing redundancy and failover are validated so a routing-process restart does not cause a service outage.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB