Junos OS EUVD-2026-101353

Exploitation requires the non-default configuration 'bgp family l2vpn auto-discovery-only' to be enabled on the Junos OS / Junos OS Evolved device, and the attacker must be an established, configured BGP peer able to send multiple BGP UPDATE messages over a single TCP session. Limiting factors: the device must have L2VPN auto-discovery-only configured (devices without this BGP family configured are not affected), and the attacker needs an active BGP adjacency with the target (a trusted routing relationship), so this is not exploitable by arbitrary internet hosts despite the PR:N rating. Impact is limited to denial of service with automatic rpd recovery; no confidentiality or integrity impact.

This is a genuine availability-focused risk for networks that enable the specific affected feature, but not a blanket emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, no-privilege, no-interaction trigger, and the 8.7 score reflects high availability impact (VA:H) plus a minor subsequent-system availability effect (SA:L) - consistent with crashing the routing protocol daemon on a network device. The supplemental metric AU:Y (Automatable: Yes) and R:A (automatic recovery, i.e., rpd restarts) indicate the DoS can be repeatedly/automatically triggered but is self-recovering, so impact is a repeated/sustained crash-loop rather than permanent compromise. Confidentiality and integrity are explicitly N - this is purely a denial-of-service, not RCE or data exposure. Critically, the raw PR:N understates a real precondition: the attacker must already be an established, configured BGP peer (a trust-adjacency relationship), and the device must have the non-default 'bgp family l2vpn auto-discovery-only' option enabled. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or public exploit code; this reads as a high-CVSS but conditionally-exploitable issue whose real-world priority depends heavily on whether the affected L2VPN auto-discovery configuration is in use.

An attacker who controls or has compromised a configured BGP neighbor of a vulnerable Junos/Junos OS Evolved device sends multiple BGP UPDATE messages over a single established TCP session while the target has 'bgp family l2vpn auto-discovery-only' enabled. This triggers a NULL pointer dereference in rpd, crashing the routing daemon and disrupting routing/forwarding until it restarts, and the attacker can repeat the UPDATEs to sustain the outage. No public exploit code was identified in the provided data.