Juniper Junos OS EUVD-2026-101417

Exploitation requires (1) the target to have an EVPN-VPWS (Virtual Private Wire Service) service configured within its EVPN deployment, and (2) the attacker to be an already-configured BGP/EVPN peer with an established adjacency to the device - the overflow is reached through protocol-valid route advertisements, so no malformed or out-of-spec packets are needed. The principal limiting factor is the trusted-peer precondition: only a configured neighbor (or an attacker who has compromised one) can deliver the triggering advertisement, which meaningfully reduces exposure versus a truly anonymous internet-facing flaw. Impact is also platform-gated: root code execution applies to Junos OS, whereas Junos OS Evolved experiences only an rpd crash (denial of service).

This is a genuine high-priority vulnerability, not a high-CVSS/low-real-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity attack with no privileges or user interaction required, and the worst-case technical impact is full root code execution on Junos OS (VC:H/VI:H/VA:H). The one meaningful mitigating factor the raw score does not fully convey is the description's requirement for a 'configured BGP/EVPN peer' - exploitation is constrained to an attacker who already holds an established BGP/EVPN adjacency with the target, which narrows the realistic threat to a compromised or malicious peer rather than any anonymous internet host. Note the PR:N rating reflects that no authentication to rpd itself is bypassed, but the peering precondition is a real exposure limiter. Signals are partially missing/conflicting: there is no EPSS score, no CISA KEV listing, and no public POC referenced, so exploitation probability cannot be quantified from the input and should be treated as unproven. Impact also diverges by platform - root code execution on Junos OS versus only an rpd crash (denial of service) on Junos OS Evolved - so the VC:H/VI:H rating applies primarily to the Junos OS case while Evolved is availability-only. A vendor patch is available, making remediation the clear action.

An attacker who controls or has compromised a device in a BGP/EVPN peering relationship with a vulnerable Junos router sends protocol-valid (not malformed) route advertisements for an EVPN-VPWS service. On Junos OS this overflows a stack buffer in the routing protocol daemon (rpd) and yields arbitrary code execution as root; on Junos OS Evolved the same input crashes rpd, disrupting routing. No public exploit code is identified at time of analysis, and the low attack complexity means a peer that can craft the advertisement needs no special timing or race conditions.