Junos OS EUVD-2026-101398

The target must be running an affected Junos OS or Junos OS Evolved release AND be configured with BGP EVPN with at least one established peering session. Exploitation requires the attacker to act as a configured BGP EVPN peer (control of a legitimate peer, a compromised peer, or on-path injection into the EVPN session) and to send a specifically malformed NLRI. This is the primary limiting factor: devices without BGP EVPN configured are not affected, and the flaw is not reachable from arbitrary untrusted hosts - only from within the EVPN peering trust boundary. No user interaction or authentication credentials on the target are required beyond the existing peer relationship, and recovery is automatic (R:A) after the rpd restart.

This is a legitimately serious availability threat but not a universal-panic issue. The CVSS 4.0 score of 8.7 (High) is driven entirely by availability impact (VA:H) with no confidentiality or integrity impact - it is a pure denial-of-service: a malformed BGP EVPN NLRI crashes the routing protocol daemon (rpd). The vector shows AV:N/AC:L/PR:N/UI:N, and the supplemental metrics AU:Y (automatable) and V:C (concentrated value) indicate the attack can be scripted and reliably reproduced, which raises operational concern. However, the practical gating factor is that the attacker must be a CONFIGURED BGP EVPN peer - exploitation is not possible from an arbitrary internet host, only from a device that already has an established EVPN peering relationship (or an on-path attacker able to inject into that session). This materially reduces real-world exposure versus the raw PR:N rating. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active or widespread exploitation. Net: prioritize patching on EVPN-enabled Junos devices (trust-boundary DoS with easy, repeatable trigger and automatic recovery per R:A), but this is not an unauthenticated-from-anywhere RCE and does not warrant emergency out-of-band response absent exposure to untrusted BGP peers.

An attacker who controls or has compromised a device configured as a BGP EVPN peer of a vulnerable Junos OS / Junos OS Evolved router sends a specifically malformed NLRI in a BGP UPDATE. The rpd daemon fails to properly validate the specified quantity in the input and crashes, disrupting routing on the target. No public exploit code was identified at time of analysis, but the condition is trivially repeatable once a peering session exists.