Junos OS EUVD-2026-101439

Exploitation requires the target Junos OS device to have the Extended Echo feature (ICMP Extended Echo probing, RFC 8335) configured - this is the explicit precondition named in the description and is the primary limiting factor, since devices without Extended Echo enabled are not exposed. Where enabled, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low attack complexity, so any device with Extended Echo configured and reachable on the network can be crashed by a remote attacker. Realistic risk is therefore bounded by how commonly operators enable Extended Echo rather than by attacker capability.

Signals are mixed and warrant careful triage. The CVSS 4.0 base score of 9.3 (Critical) is driven by a fully-open exploitability profile - AV:N/AC:L/AT:N/PR:N/UI:N (remote, low-complexity, unauthenticated, no user interaction) - which is consistent with the description of an unauthenticated, network-based attacker. However, there is a material internal conflict: the vendor-supplied vector asserts VC:H/VI:H/VA:H (full confidentiality, integrity, and availability impact), yet the description characterizes the flaw strictly as a denial of service via kernel crash, which should map to availability-only impact (VC:N/VI:N/VA:H). This inflates the headline score; a pure DoS integer-underflow (CWE-191) crash does not plausibly yield confidentiality or integrity loss, so the real severity is closer to High (~7.5) than the stated 9.3 - verify impact scope with Juniper JSA112188. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so probabilistic and real-world-exploitation signals are entirely absent and cannot corroborate the high CVSS. Critically, exploitation is gated on a non-default prerequisite - the device must have Extended Echo configured - which sharply narrows the exposed population and makes this a conditional rather than universal risk. Net: treat as a prioritized patch for devices with Extended Echo enabled, but recognize the 9.3 overstates impact for a crash-only DoS and that no exploitation activity is evidenced in the provided data.

A remote, unauthenticated attacker sends specially crafted ICMP Extended Echo (RFC 8335) packets to a Juniper Junos OS device that has the Extended Echo feature configured. The malformed input triggers an integer underflow in kernel packet processing, crashing the kernel and causing the device to reboot, resulting in a denial of service. No public exploit identified at time of analysis; realistic given the low-complexity, unauthenticated network vector.