Juniper Junos OS EUVD-2026-101370

Exploitation requires the target to be a Juniper MX-Series device running an affected Junos OS release (e.g. before 23.4R2-S8.13, 25.4R1-S3, 23.2R2-S7.7, 25.2R2-S2, 24.4R2-S5, 26.2R1-S2, or 24.2R2-S5.5) and actively processing SCTP traffic through the netsctp.ko module - SCTP is primarily used in telecom/mobile signaling deployments, so devices not handling SCTP are not exposed. No authentication, privileges, or user interaction are needed (PR:N/UI:N), and the attacker only needs network-level reachability to the SCTP processing path. The practical limiting factor is the SCTP precondition and network exposure of that path, not any credential or configuration gating.

This is a genuinely actionable network-availability issue, not merely a high-CVSS paper risk. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation requiring no user interaction, with VA:H confirming high availability impact on the vulnerable device and SA:L indicating a minor knock-on availability effect on downstream systems - consistent with a core MX-Series router locking up and disrupting traffic it forwards. The CWE-835 infinite-loop mechanism aligns with the pure-DoS, no-confidentiality/no-integrity impact (VC:N/VI:N). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so exploitation status is 'no public exploit identified at time of analysis'; the absence of these signals is not evidence of safety but does argue against imminent commodity exploitation. Note the vendor's vector carries V:C (concentrated value) and AU:Y (automatable), which the advisory treats as reasons the metric is weighted toward 8.7 despite the DoS-only impact. The main caveat is exploitability depends on the device actually processing SCTP traffic (see exploitation_conditions) - a real-world precondition the CVSS AV:N score does not capture - so defenders on MX platforms that do not handle SCTP face materially lower risk. Verify SCTP usage and patch state against JSA112196.

An unauthenticated attacker with network reachability to an SCTP-processing MX-Series router sends crafted SCTP packets that drive the netsctp.ko kernel module into an unterminated loop, hanging the affected processing path and denying service. No exploit code is publicly identified, but the low attack complexity and lack of authentication or user interaction make reliable triggering plausible once the packet structure is understood. Impact is limited to denial of service, with a minor availability effect on traffic the router carries.