Junos OS Evolved EUVD-2026-101369

Exploitation requires that LACP (Link Aggregation Control Protocol) be configured and enabled on an aggregated-Ethernet member port - the crafted frame must be received on such a port - so devices without LACP-based aggregation configured are not exposed. The attacker must also be Layer-2-adjacent (AV:A): positioned on the same local broadcast domain or directly connected to the member port, which rules out purely remote internet-based exploitation and typically requires a foothold on the local segment or physical/logical access to the link. No authentication, privileges, or user interaction are required once adjacency and an LACP-enabled port exist (PR:N/UI:N). The primary limiting factors are therefore the LACP-enabled-port configuration dependency and the local Layer-2 adjacency requirement.

This is a genuine but bounded operational risk, not a drop-everything emergency. The CVSS 4.0 base score of 7.1 is driven entirely by an availability impact (VA:H) with no confidentiality or integrity exposure (VC:N/VI:N), so the worst realistic outcome is a crash/denial of service of the lacpd process, not code execution or data theft. The attack vector is Adjacent (AV:A), meaning the attacker must be Layer-2-adjacent - on the same broadcast domain or directly connected to an LACP-enabled aggregated-Ethernet member port - which substantially limits the exploitation population compared to a network-reachable (AV:N) flaw; an internet-based attacker cannot reach this directly. Complexity and attack requirements are low (AC:L/AT:N) and no privileges or user interaction are needed (PR:N/UI:N), so for an attacker who already has that adjacency, triggering it is easy. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk is theoretical-but-plausible rather than demonstrated. The vendor (Juniper) reported it and a patch is available, which is the dominant mitigating fact. Net: prioritize patching for exposed L2 segments and provider-edge/aggregation devices, but this is a high-CVSS-for-availability issue with a meaningful adjacency barrier, not a wormable critical.

An attacker with Layer-2 adjacency - for example, a compromised host or rogue device on the same LAN segment as a Juniper router/switch's aggregated-Ethernet bundle - sends a specially crafted LACP frame to an LACP-enabled member port. The malformed frame triggers an out-of-bounds write (CWE-787) in the lacpd daemon, crashing it and disrupting link-aggregation control and traffic forwarding. No public exploit was identified in the provided data, and the Adjacent attack vector means the attacker must already be on the local L2 segment.