Junos OS EUVD-2026-101436

Exploitation requires that the targeted Junos OS device be actively performing CMP (Certificate Management Protocol) enrollment or automatic certificate re-enrollment - the malformed packet is only processed by the pkid daemon during that certificate exchange. Devices not configured to use CMP-based enrollment/re-enrollment are not exposed through this vector, which is the primary limiting factor. No authentication is required (PR:N) and no user interaction is needed (UI:N), so against a device in the enrollment window a remote unauthenticated attacker can trigger it; impact is limited to denial of service (availability only), with no confidentiality or integrity consequence. Affected trains include 23.2 (<23.2R2-S7.7), 23.4 (<23.4R2-S8.13), 24.2 (<24.2R2-S5.5), 24.4 (<24.4R2-S5), 25.2 (<25.2R2-S2), 25.4 (<25.4R1-S3), and 26.2 (<26.2R1-S2).

This is a credible operational priority for Juniper-dependent networks, though not an emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, and the impact profile is pure availability (VA:H, SA:L) with no confidentiality or integrity loss - consistent with a NULL pointer dereference (CWE-476) crashing the pkid PKI daemon. The 8.7 score is high precisely because it is remote and unauthenticated, not because of data exposure. However, exploitation is gated by a real-world condition the raw vector understates: the malformed packet must be processed during CMP (Certificate Management Protocol) enrollment or automatic certificate re-enrollment, so only devices actually performing CMP-based certificate operations are in the exploitable window. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization. Net: treat as a patch-soon availability risk for devices using CMP enrollment, rather than a mass-exploited critical. Note the tension worth verifying - AV:N/AC:L implies trivial network exploitation, but the CMP-enrollment precondition means the realistic attack surface is narrower than the score alone suggests.

A remote, unauthenticated attacker who can reach a Junos OS device that is performing CMP certificate enrollment or automatic re-enrollment sends a specially malformed packet to the enrollment exchange. The pkid daemon dereferences a NULL pointer while parsing it, crashing the PKI process and denying certificate services (and potentially disrupting dependent functions). No public exploit is identified at time of analysis, so an attacker would need to develop the trigger and time it to an active enrollment window.