Junos OS EUVD-2026-101395

Two concrete preconditions must both hold: (1) the attacker must have access to a CONFIGURED BGP EVPN peer - i.e. an established EVPN peering/trust relationship with the target, not arbitrary network reach; and (2) the device must have the l2vpn-evpn RIB telemetry sensor subscribed (a Junos Telemetry Interface streaming configuration that is not enabled by default). Limiting factors for defenders: the box must be deployed as part of an EVPN fabric, the specific telemetry sensor subscription gates the vulnerable code path, and the attacker needs an existing peer position; impact is availability-only (rpd crash) and self-recovering once the daemon restarts and reconverges. Only Junos OS / Junos OS Evolved releases in the listed affected ranges are vulnerable.

This is a genuine but conditional priority, not an inflated high-CVSS score. The vendor-supplied CVSS 4.0 vector (8.7) reflects a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N), no-interaction flaw with high availability impact on the vulnerable system (VA:H) and low subsequent-system availability impact (SA:L) - consistent with an rpd crash cascading into routing disruption. The threat metrics reinforce operational concern: AU:Y (automatable) and V:C (concentrated value) indicate it could be scripted against high-value routing infrastructure, while R:A (automatic recovery, i.e. the daemon restarts) tempers persistent impact. Crucially, the raw AV:N/PR:N/AC:L signals OVERSTATE real-world ease: the description imposes two hard preconditions - the attacker must already have access to a CONFIGURED BGP EVPN peer (a pre-established trust relationship, not arbitrary internet access), AND the l2vpn-evpn RIB telemetry sensor must be subscribed (a non-default operational condition). These are not captured in the AT:N field the vendor chose, which is why an independent assessor would argue AT:P / AC:H. No EPSS score, KEV listing, or POC was provided; absence of KEV plus a pure DoS (no C/I impact) means this is not mass-exploitation material but rather a targeted risk to EVPN fabrics running streaming telemetry. SSVC-style read: exploitation=none observed, automatable=yes, technical impact=partial (availability-only, auto-recovering) - supporting a 'Track/Scheduled' rather than 'Act now' posture absent evidence of active exploitation.

An attacker who controls or has compromised a device peering over BGP EVPN with a vulnerable Junos/Junos Evolved router sends a crafted EVPN route that triggers an out-of-bounds write during route processing. When the l2vpn-evpn RIB telemetry sensor is subscribed, this crashes the rpd daemon, dropping all routing adjacencies until rpd restarts and reconverges. No public exploit identified at time of analysis; exploitation requires an existing EVPN peering relationship rather than arbitrary remote access.