Junos OS EUVD-2026-101434

Exploitation requires the affected device to be deployed as a VXLAN/EVPN gateway with the OVSDB control plane enabled and managed by an external SDN controller - this is not a default configuration on most Junos deployments. The attacker must occupy the SDN-controller role on the adjacent management/control network, either by compromising the legitimate controller or inserting a malicious one (per the description, 'a malicious or compromised SDN-controller'). Limiting factors: adjacent (not internet-wide) attack vector, dependence on the OVSDB-managed VXLAN feature being configured, and the need to control the trusted controller channel; these substantially narrow realistic exploitation despite the PR:N metric. Running software outside the fixed trains (e.g., <23.2R2-S7.7, <24.2R2-S5.5, <24.4R2-S5, <25.2R2-S2, <25.4R1-S3, <26.2R1-S2) is also required.

This is a credible but conditional priority rather than a mass-exploitation emergency. The CVSS 4.0 vector (8.7 High) is internally consistent with the description: AV:A (adjacent) and AT:N/AC:L reflect that the attack rides the OVSDB control channel between an SDN controller and the Junos VXLAN Gateway Daemon, while VC:H/VI:H/VA:H capture the possible remote code execution plus the complete OVSDB control-plane outage, and SA:L reflects limited downstream availability impact. PR:N is reported, meaning the vgd daemon does not require the attacker to authenticate at the protocol level - but the real precondition is that the attacker IS, or has already compromised, the trusted SDN controller, which is a significant barrier that the raw PR:N metric understates. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation is theoretical at this time and likely to be targeted (requiring controller compromise and a specific EVPN/VXLAN-OVSDB deployment) rather than opportunistic. Signals are therefore aligned but modest: high technical impact, high-value networking target, but a narrow attack surface gated by control-plane trust and adjacency. Note the tension between the nominal PR:N and the description's 'malicious or compromised SDN-controller' prerequisite - verify the trust model against Juniper advisory JSA112188 before treating this as unauthenticated.

An attacker who has compromised the SDN controller (or inserted a rogue controller) on the EVPN/VXLAN management network sends crafted OVSDB messages to the Junos VXLAN Gateway Daemon, overflowing a heap buffer in vgd. This crashes the OVSDB control plane, causing a complete overlay outage, and may allow arbitrary code execution on the device. No public exploit identified at time of analysis, so this reflects the described capability rather than an observed campaign.