Junos OS EUVD-2026-101366

Exploitation requires that the target Junos OS / Junos OS Evolved device be configured for RSVP-TE with associated-bidirectional LSP signaling - devices without MPLS traffic-engineering / RSVP-TE enabled are not exposed. The attacker must be network-adjacent (AV:A): they need an RSVP-TE signaling relationship or adjacency to the device (e.g., a directly connected or TE-domain peer), not arbitrary remote Internet reachability. No authentication (PR:N) and no user interaction (UI:N) are needed once that adjacency exists. The adjacency requirement and the dependency on a non-default TE feature are the primary factors limiting real-world exploitation; impact is limited to availability (routing process crash) with automatic recovery, not code execution or data exposure.

This is a genuine but bounded denial-of-service issue rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) indicates an adjacent, low-complexity, unauthenticated trigger with no user interaction, which is a favorable profile for an attacker, but the impact is confined to availability (VA:H, with only SA:L on subsequent systems) - there is no confidentiality or integrity loss (VC:N/VI:N), consistent with CWE-617 Reachable Assertion causing an rpd crash. The adjacency requirement (AV:A, not AV:N) is the single most important limiting factor: the attacker must have a Layer-2/signaling-adjacent position with an RSVP-TE relationship to the device, which sharply narrows the realistic attacker population to peers on the MPLS/TE control plane rather than arbitrary internet hosts. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the AU:Y (automatable) and R:A (automatic recovery) secondary metrics suggest that while a crash could be scripted, the routing process typically restarts, limiting persistent damage. Net: a real patch-worthy priority for carriers and enterprises running RSVP-TE associated-bidirectional LSPs, but not a drop-everything issue for networks that do not deploy that feature.

An attacker with an RSVP-TE signaling adjacency to a vulnerable Junos OS or Junos OS Evolved router (for example a malicious or compromised MPLS peer on the same TE domain) sends crafted associated-bidirectional LSP signaling messages. The malformed signaling reaches an assertion in the rpd routing process, crashing it and disrupting routing/forwarding until the process recovers. No authentication is required (PR:N) and no public exploit code is known at time of analysis.