Juniper Junos OS EUVD-2026-101386

Exploitation requires the attacker to be on a directly connected (adjacent, link-local) network to the target - this is the primary limiting factor and precludes exploitation from arbitrary remote/internet locations. The target must be a Juniper MX Series device running Junos OS or an ACX Series device running Junos OS Evolved, and the device must be processing IGMPv3 membership reports, implying IGMP/multicast is configured and active on the receiving interface. No authentication and no user interaction are required (PR:N/UI:N), and attack complexity is low (AC:L/AT:N), so an adjacent attacker on a multicast-enabled segment can trigger the rpd crash reliably. Impact is limited to denial of service (availability); there is no confidentiality or integrity impact.

This is a moderate-priority availability issue rather than a critical emergency. The CVSS 4.0 score of 7.1 (High) is driven entirely by availability impact (VA:H with subsequent SA:L) - there is no confidentiality or integrity impact. The key risk-limiting factor is the attack vector: AV:A (Adjacent) means the attacker must be on a directly connected (same-segment/link-local) network to send the malicious IGMPv3 membership report, which substantially narrows the exploitable population versus a routable network attack. Offsetting that, AC:L/AT:N/PR:N/UI:N mean that once an attacker has that adjacency, exploitation is low-complexity, unauthenticated, and requires no user interaction, and crashing the rpd routing process causes a meaningful service disruption on carrier/enterprise routers. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active or widespread exploitation at this time - exploitation status is accordingly 'no public exploit identified.' Note the input vector is CVSS 4.0 only; no CVSS 3.1 vector or EPSS was supplied, so cross-signal comparison is limited to the 4.0 metrics plus KEV/POC absence. Net: treat as a prioritized patch for exposed MX/ACX multicast-enabled edge devices, but not a drop-everything remote-unauthenticated-internet threat.

An attacker with a foothold on a network segment directly connected to a vulnerable Juniper MX (Junos OS) or ACX (Junos OS Evolved) device - for example a compromised host or rogue device on the same L2 link - sends a crafted IGMPv3 membership report to the router. The routing protocol daemon (rpd) dereferences a NULL pointer while processing the report and crashes, disrupting routing on the affected device. No public exploit code was identified in the provided data, and the adjacency requirement (AV:A) means the attacker cannot trigger this from an arbitrary remote network.