Juniper Junos OS EUVD-2026-101355

Exploitation requires that the affected Junos OS / Junos OS Evolved device be configured with an inter-region segmented VRF using 'protocols mvpn inter-region-template' - this is a non-default, specialized multicast-VPN deployment, so devices without this configuration are not vulnerable. The attacker must additionally be a configured MVPN neighbor, meaning an established BGP MVPN peering/trust relationship with the target is required; a purely external unauthenticated host with no peering cannot trigger the flaw. These two conditions (specialized inter-region MVPN config plus existing peer adjacency) substantially limit the realistic attack surface despite the network-reachable, low-complexity CVSS profile. Impact is limited to denial of service (rpd routing process disruption) with automatic recovery, and no confidentiality or integrity compromise.

CVSS 4.0 base score is 8.7 (High), driven by AV:N/AC:L/PR:N/UI:N with high availability impact on the vulnerable system (VA:H) and a low subsequent-system availability impact (SA:L), indicating a scope-crossing effect on routing. However, the raw score overstates opportunistic risk: the description constrains the attacker to a 'configured MVPN neighbor,' meaning an established BGP MVPN peering/trust relationship is required even though the CVSS vector encodes PR:N (no authentication credentials on the target). The flaw also only affects availability - there is no confidentiality or integrity impact (VC:N/VI:N) - and the supplemental Recovery metric is Automatic (R:A), implying rpd restarts/recovers without manual intervention, which further limits lasting damage. Conversely, the supplemental Automatable:Yes (AU:Y) signal suggests that once a working trigger exists it could be scripted against many peers. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no evidence of in-the-wild exploitation; this reads as a credible but condition-gated DoS rather than a broadly opportunistic threat. Note the mismatch to flag explicitly: the vector says PR:N but the prerequisite of being a configured MVPN neighbor is effectively a trust/adjacency requirement - verify peering assumptions before prioritizing.

An attacker who already participates as a configured BGP MVPN neighbor on a Junos device that has an inter-region segmented VRF with 'protocols mvpn inter-region-template' sends a malicious BGP MVPN update. The update triggers an incomplete cleanup condition in the rpd routing process, crashing it and causing a denial of service to routing on the affected system. No public exploit code was identified in the provided data.