Junos OS EUVD-2026-101401

Exploitation requires two specific conditions stated in the advisory: (1) the BGP Monitoring Protocol (BMP) feature must be enabled on the device, and (2) the attacker must be a BGP peer - i.e., have an established BGP session with the target, meaning a configured neighbor or a compromised/upstream peer rather than an arbitrary host. Limiting factors: BMP is not enabled in default configurations, and BGP sessions are normally established only with explicitly configured neighbors, so an attacker must occupy or compromise a peering position. No authentication beyond the BGP adjacency is required (PR:N). Affected releases span numerous Junos OS and Junos OS Evolved trains (e.g., below 23.4R2-S8.13, 24.4R2-S5, 25.4R1-S3, 26.2R1-S2 and corresponding EVO builds); devices patched to the fixed versions are not exploitable.

This is a genuine high-priority issue, not an inflated high-CVSS-but-low-risk case, though its exploitability is gated by real preconditions. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) scores 9.2 and reflects an unauthenticated, network-reachable flaw in the rpd routing daemon with high confidentiality, integrity, and availability impact - consistent with the description's claim of denial of service plus potential root-level command execution. Two signals temper raw severity: the 4.0 'AT:P' (Attack Requirements: Present) metric encodes that exploitation is not against arbitrary targets but requires a specific condition - here, an established BGP peering relationship AND the BMP feature enabled - and the vector's AU:Y / R:A / V:C modifiers indicate user/automation interaction assumptions and a vulnerable, recoverable, concentrated condition. EPSS is not provided, KEV status is not listed (so NOT confirmed exploited), and no POC is referenced. The flaw is CWE-121 stack-based buffer overflow in an unauthenticated network parser, which historically trends toward exploitability, but 'potential root-level command execution' is stated as potential, not demonstrated. Net: patch urgently on devices where BMP is enabled and BGP peers are not fully trusted; the risk is real but conditional rather than ubiquitous drive-by exploitation.

On a Junos OS or Junos OS Evolved device with BGP Monitoring Protocol (BMP) enabled, an attacker who controls or has compromised a BGP peer sends specially crafted BGP route updates that overflow a stack buffer in the rpd routing daemon. This crashes rpd (routing denial of service) and may allow root-level command execution on the device. No public exploit identified at time of analysis; exploitation requires an active BGP adjacency, so the attacker must be a configured/compromised neighbor rather than an arbitrary internet host.