Juniper Junos OS EUVD-2026-101453

Exploitation requires BGP to be configured on the target Junos OS / Junos OS Evolved device and an adjacent BGP peering relationship with the attacker (AV:A, PR:L), so the attacker must be an established or spoofed BGP neighbor rather than an arbitrary remote host. The specific trigger is the device adding the graceful-shutdown sender community while attempting to advertise a route after receiving a specific crafted set of BGP communities - meaning the device must be in a route-advertising path where this community handling occurs. Limiting factors: no user interaction is needed (UI:N) but the attacker needs an accepted BGP session, which constrains exploitation to peers within the routing trust boundary; impact is availability-only (rpd crash/DoS), with no confidentiality or integrity effect.

This is a genuine but moderate-priority availability issue, consistent with its 6.8 (Medium) CVSS score rather than a top-tier emergency. The CVSS vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H shows the dominant characteristics: an adjacent attacker (AV:A), low complexity (AC:L), requiring low privilege (PR:L, i.e. an established/configured BGP session), with no confidentiality or integrity impact (C:N/I:N) and high availability impact (A:H) amplified by a scope change (S:C) because a crash of the routing protocol daemon degrades routing for the whole device and attached network. No EPSS score, KEV listing, or public POC was provided in the input, so by the precision rules this is 'no public exploit identified at time of analysis.' The key mitigating factor is that exploitation is not remote-internet-wide: the attacker must be an adjacent BGP neighbor whose routes the victim processes, which typically means a peering relationship with some trust. There is no SSVC decision data, no EPSS, and no vendor exploitation claim in the input, so widespread opportunistic exploitation is unlikely; the realistic threat is a malicious or compromised BGP peer. The CVSS vector and the description are consistent (both point to an adjacent BGP peer and a DoS), so there are no conflicting signals here - the main limitation is simply that only a single vendor advisory reference is available for corroboration.

A malicious or compromised BGP peer adjacent to a Junos OS / Junos OS Evolved router sends a specifically crafted set of BGP communities. When the victim router processes these and adds the graceful-shutdown sender community while attempting to advertise the route, an out-of-bounds write (CWE-787) crashes the rpd routing daemon, disrupting routing. No public exploit code is identified in the provided data.