Junos OS EUVD-2026-101448

Exploitation requires the target Junos OS / Junos OS Evolved device to be running BGP with Long-Lived Graceful Restart (LLGR) in a topology where an LLGR-stale route is readvertised to a peer group that is NOT configured for LLGR - this mixed LLGR/non-LLGR peer-group configuration is the specific trigger condition. The attacker must be, or must control, an established BGP peer able to inject the LLGR-stale route update (so there is an implicit adjacency/topology prerequisite despite the PR:N rating). Limiting factors: no impact on devices without BGP configured, without LLGR in use, or without the stale route crossing into a non-LLGR peer group; impact is limited to availability (rpd crash and routing disruption), with no data exposure or code execution.

This is a genuine high-priority availability issue for networks that run BGP on Juniper gear, but the signals are mixed and should be read carefully. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 and rates this as network-reachable, low-complexity, and requiring no privileges or user interaction, with the only impact being high availability loss (VA:H / A-equivalent) and a low subsequent-system availability impact (SA:L) reflecting routing disruption - confidentiality and integrity are explicitly N, so this is a pure denial-of-service (CWE-665 Improper Initialization leading to an rpd crash). The PR:N rating is technically correct in that no device credentials are needed, but it understates a real limiting factor: the attacker must be a configured, established BGP peer (or be able to source an LLGR-stale route that reaches the target), so exploitation presupposes an existing BGP adjacency or a compromised/malicious neighbor rather than arbitrary Internet-wide access. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk is therefore driven by severity and reachability rather than by observed in-the-wild activity. Net assessment: treat as a real patch priority for BGP-speaking Junos/Junos Evolved deployments (rpd crash can disrupt all routing on the device), but it is not a mass-exploitation or remote-code-execution scenario - it is a conditional, peer-dependent DoS.

An attacker who controls or has compromised a BGP peer of a vulnerable Junos/Junos OS Evolved router advertises a route carrying an LLGR (Long-Lived Graceful Restart) stale marking. When the receiving router readvertises that LLGR-stale route to a peer group that is not configured for LLGR, improper initialization in rpd triggers a daemon crash, dropping BGP sessions and disrupting routing. No public exploit code is identified at time of analysis, and the attacker must already be a BGP peer, so this is low-complexity but peer-dependent.