Junos OS EUVD-2026-101345

Exploitation requires that the target device be configured for BGP-LS (BGP Link-State / RFC 7752 topology distribution) and that the attacker hold or hijack an established BGP peering session with the device - BGP-LS is not a default configuration and is typically deployed only where topology is exported to SDN controllers or path-computation elements. The description states the attacker is authenticated/network-based, implying a valid BGP adjacency rather than arbitrary unauthenticated internet access, which is the primary limiting factor; devices not running BGP-LS, or peering only with trusted and uncompromised neighbors, are not realistically exposed. Impact is confined to availability of the rpd routing process (denial of service) with automatic recovery, and no confidentiality or integrity impact applies.

This is a genuine but conditional priority. The CVSS 4.0 score of 8.7 (High) is driven entirely by availability impact (VA:H) against the routing daemon with a network attack vector and low attack complexity (AV:N/AC:L/AT:N). However, the real-world risk is substantially narrower than the raw score suggests. There is a direct CONFLICT in the data: the CVSS vector encodes PR:N (no privileges), yet the description explicitly states an 'authenticated network-based attacker' - for BGP-LS this almost certainly means the attacker must already have an established, configured BGP peering session with the target, which is a meaningful barrier not reflected in PR:N. No EPSS score, KEV listing, or POC is present in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is not confirmed active exploitation and should not be treated as such. The CVSS 4.0 supplemental metrics reinforce caution rather than alarm: Automatable=Yes (AU:Y) and Recovery=Automatic (R:A), meaning a crash is self-recovering (rpd typically restarts), limiting durable impact to transient routing disruption. Net assessment: a credible availability threat for operators running BGP-LS with untrusted or compromisable peers, but not a drop-everything internet-wide emergency given the required peering relationship and absence of exploitation evidence.

An attacker who controls or compromises a device with an established BGP-LS peering session to a target Junos/Junos OS Evolved router sends crafted BGP-LS (link-state) routing updates. The malformed update triggers a reachable assertion in the rpd (routing protocol daemon) process, crashing it and disrupting routing on the device until it recovers. No public proof-of-concept is identified in the available data; low attack complexity (AC:L) means no special timing or race conditions are required once a peering session exists.