Juniper Junos OS EUVD-2026-101400

Exploitation requires the target Junos OS / Junos OS Evolved device to be configured for EVPN multihoming with preference-based designated-forwarder (DF) election - this is the exact feature that must be enabled for the vulnerable rpd code path to be reachable; devices without EVPN multihoming or using a different DF-election mode are not exposed. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed and the trigger is remote over the network, but the attacker must have network reachability to the EVPN control plane of the device. The principal limiting factor is this non-default configuration dependency; impact is confined to availability (routing-daemon DoS) with no confidentiality or integrity effect.

This is a credible operational priority for networks running the affected feature, but not a mass-exploitation crisis. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remote, low-complexity, unauthenticated trigger with high availability impact on the vulnerable system (VA:H) and minor subsequent-system availability impact (SA:L), consistent with a routing-plane denial of service. The supplemental metrics reinforce concern on one axis (AU:Y, automatable) but soften it on another (R:A, automatic recovery; RE:M, medium response effort), implying the daemon disruption may clear or restart rather than permanently brick the device. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public POC is referenced, so there is no public exploit identified at time of analysis - the signal set is 'high CVSS, vendor-reported, no evidence of exploitation.' A key qualifier: the CVSS base treats this as PR:N/AT:N default-reachable, yet the description scopes the trigger to 'EVPN multihoming with preference-based designated-forwarder election,' a non-default feature - so the raw 8.7 overstates risk for the large majority of Junos deployments that do not run this specific configuration. Confidentiality and integrity are unaffected (VC:N/VI:N); this is purely availability.

An attacker with network reachability to a Junos OS or Junos OS Evolved device participating in an EVPN multihoming fabric sends crafted EVPN control-plane traffic that exercises the preference-based designated-forwarder election logic in the routing protocol daemon (rpd). The malformed/edge-case input drives rpd into an infinite loop (CWE-835), consuming the process and denying routing service. No authentication or user interaction is required per the CVSS vector, but the target must have the vulnerable EVPN DF-election configuration active; no public exploit code is identified.