Juniper Junos OS EUVD-2026-101336

The device must be configured for BGP MVPN (multicast VPN) signaling, and the attacker must be - or must control/impersonate - an established, configured BGP MVPN peer of the target; the malicious trigger is a crafted MVPN signaling update. This pre-existing peering/trust relationship is the primary limiting factor: devices not running BGP MVPN are not exposed, and a peer must already be configured on the target, which constrains exploitation to the BGP MVPN trust boundary rather than arbitrary internet hosts. Impact is limited to availability (rpd denial of service); supplemental metrics indicate automatic recovery, so there is no confidentiality or integrity effect.

This is a genuine availability-impacting vulnerability but its real-world risk is bounded by a significant precondition. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 (High) and nominally indicates remote, low-complexity, unauthenticated exploitation with no user interaction, with impact confined to availability (VA:H, SA:L; VC/VI/VA-confidentiality/integrity = N). However, the description states the trigger must come from 'a configured BGP MVPN peer,' meaning exploitation requires a pre-established BGP peering/trust relationship - a material limiting factor that the PR:N metric does not capture. This is the key tension: the vector reads as fully unauthenticated, but operationally the attacker must already be (or compromise/spoof) a configured MVPN neighbor, narrowing the realistic threat population to peers inside a BGP MVPN trust boundary. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Supplemental CVSS 4.0 metrics (AU:Y automatable, R:A automatic recovery, V:C concentrated value, RE:M moderate response effort) suggest the condition could be triggered repeatably but that the device recovers automatically, consistent with a routing-daemon crash/restart rather than persistent compromise. Net: a real patch-worthy DoS for operators running BGP MVPN, but not a drop-everything internet-wide threat, because impact is availability-only and the attacker must sit within an established peering relationship.

An attacker who controls or has compromised a router that is a configured BGP MVPN peer of a Junos OS / Junos OS Evolved device sends a specially crafted BGP MVPN signaling update containing a malformed/out-of-range specified quantity. The rpd (routing protocol daemon) fails to properly validate the input and crashes, dropping routing adjacencies and causing a denial of service. No public exploit code is identified at time of analysis, and the attack is availability-only with automatic recovery on daemon restart.