Junos OS Evolved EUVD-2026-101348

Exploitation requires that at least one firewall counter be explicitly configured on the Junos OS Evolved device - if no firewall counter exists, the vulnerable fwstatsd code path is not reachable. The attacker must also have SNMP reachability to the device and, per the advisory description, authenticated SNMP access (valid community string / SNMPv3 credentials) to issue the firewall-counter MIB query. Limiting factors: the dependency on an existing firewall-counter configuration (not guaranteed on every deployment), the need for SNMP to be enabled and reachable on an exposed interface, and the stated authentication requirement - the CVSS vector's PR:N appears to contradict this and should be verified against Juniper's advisory.

This is a genuine but bounded operational risk rather than a top-tier emergency. The CVSS 4.0 base score of 8.7 (High) is driven entirely by availability impact (VA:H) with no confidentiality or integrity exposure (VC:N/VI:N) - consistent with CWE-617 (Reachable Assertion), which crashes a process rather than yielding code execution or data. The input provides no EPSS score, no CISA KEV listing, and no indication of public exploit code, so based on available signals this is 'no public exploit identified at time of analysis.' A key conflict must be flagged: the supplied CVSS 4.0 vector contains PR:N (no privileges), yet the description explicitly states an 'authenticated network attacker' and the attack is an SNMP MIB query, which in practice requires valid SNMP credentials/community access - verify the true privilege requirement with Juniper, as PR:N likely understates the access needed. The CVSS supplemental metrics reinforce moderate operational concern: AU:Y (Automatable) and R:A (Recovery: Automatic) suggest the attack can be scripted but the device self-recovers, limiting lasting damage. Net: prioritize for patching on exposed management planes, but the authentication requirement, availability-only impact, and absence of any exploitation evidence place it below internet-facing unauthenticated RCE class issues.

An attacker with SNMP access to the management interface of a Junos OS Evolved device that has at least one firewall counter configured sends a crafted firewall-counter MIB query. The query triggers a reachable assertion in the fwstatsd daemon, crashing it and causing a denial of service against firewall statistics processing. No public proof-of-concept is identified at time of analysis, and the low attack complexity (AC:L) means the request itself is simple once SNMP reachability and credentials are obtained.