Junos OS EUVD-2026-101449

Exploitation requires the attacker to be a CONFIGURED BGP peer of the target device (an established BGP peering/trust relationship must already exist) and to send a specifically malformed BGP MCAST-TREE update that the rpd then attempts to re-advertise - i.e., the target must participate in BGP multicast (MCAST-TREE / NLRI) routing. Limiting factors: the attacker must occupy or compromise a neighboring BGP speaker (not arbitrary remote internet hosts), so blast radius is bounded by the peering topology; however, no authentication to the Junos device itself, no user interaction, and no non-default device privileges are needed, and the malformed NLRI re-advertisement can propagate the condition to further peers. Affects Junos OS and Junos OS Evolved versions below the fixed releases listed in EUVD (e.g., 23.2R2-S7.7, 24.2R2-S5.5, 25.2R2-S2, 26.2R1-S2 and their -EVO equivalents).

This is a genuine operational priority for networks running affected Junos OS / Junos OS Evolved, though not an internet-wide mass-exploitation event. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores it 8.7 (High) driven purely by availability impact (VA:H) plus a subsequent-system availability effect (SA:L) - there is no confidentiality or integrity impact (VC:N/VI:N). The signals are largely consistent: network vector, low complexity, no user interaction, and a vendor patch confirm a real, repeatable DoS. The key nuance CVSS underweights is the trust prerequisite - although the vector encodes PR:N (no authentication to the device), exploitation requires the attacker to already be a CONFIGURED BGP peer of the target, meaning an established peering/trust relationship must exist. This is not internet-reachable against arbitrary hosts; it requires a malicious, compromised, or misconfigured BGP neighbor. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or public exploit code; the real-world risk is therefore 'patch promptly in affected carrier/enterprise routing environments' rather than 'emergency zero-day.' The SA:L subsequent-system impact reflects that the malformed MCAST-TREE NLRI is re-advertised, so a single malicious update can propagate the condition to downstream peers - raising blast radius beyond the directly peered device.

An attacker who controls or has compromised a device in a BGP peering relationship with an affected Junos router sends a specifically malformed BGP MCAST-TREE update. When the receiving rpd attempts to re-advertise this NLRI to other peers, the routing protocol daemon crashes, causing a denial of service; because the NLRI is propagated, adjacent peers may also be affected. No public exploit code was identified in the provided data.