Junos OS EUVD-2026-101415

Exploitation requires that the target Junos OS or Junos OS Evolved device has BOTH SNMP and AAA (the authd authentication daemon) enabled - this is the explicit configuration precondition stated in the advisory. The attacker must also possess SNMP read access (PR:L), meaning valid read community/credentials, not merely network reachability. Limiting factors: devices with SNMP disabled, AAA/authd not in use, or SNMP restricted to trusted management networks via ACLs are not exposed; because the daemon is authd, only configurations that route SNMP-triggered authentication through it are affected. The flaw is network-reachable (AV:N) with low complexity (AC:L) and no user interaction (UI:N), so once SNMP read access and the SNMP+AAA configuration exist, exploitation against affected versions is straightforward.

This is a credible high-priority issue rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low privileges (PR:L = SNMP read access), with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) - consistent with the description's claim of root-level code execution or denial of service. The vendor (Juniper) confirms a patch is available and the flaw affects core routing/switching platforms, which raises operational concern. However, several exploitation-pressure signals are MISSING from the input: there is no EPSS probability provided, the vulnerability is NOT in CISA KEV, and no public POC is indicated - so there is no public exploit identified at time of analysis. The effective barrier is that the attacker must already hold valid SNMP read credentials AND the device must have both SNMP and AAA (authd) enabled, which meaningfully narrows the exploitable population versus a fully unauthenticated remote flaw. Net assessment: patch promptly on exposed/managed-plane devices given root impact and low complexity, but absence of KEV/POC/EPSS data suggests exploitation is not yet widespread - prioritize by SNMP exposure rather than treating as an active-attack emergency.

An attacker who has obtained (or by default-weak-community-string guessed) SNMP read access to a Junos OS / Junos OS Evolved device with SNMP and AAA enabled sends a specially crafted SNMP packet that overflows a stack buffer in the authd daemon. The malformed packet either crashes authd (causing a denial of service) or is leveraged to execute arbitrary code as root on the device. No public exploit is identified at time of analysis, so this scenario is inferred from the description and CVSS vector rather than a demonstrated POC.