Junos OS EUVD-2026-101454

Exploitation requires (1) the target Junos OS / Junos OS Evolved device to be deployed in a BGP traffic-engineering scenario, and (2) an already-established BGP session between the attacker and the device over which the crafted, valid, optional non-transitive BGP update is received. Limiting factors: the attacker must be an adjacent BGP peer or able to inject into an existing session (AV:A), so arbitrary remote/internet exploitation is not possible; devices not configured for BGP traffic engineering are not affected; and impact is a self-recovering RPD restart (R:A) causing temporary traffic loss during reconvergence rather than persistent compromise. Although CVSS encodes PR:N, the practical requirement of an established BGP peering relationship meaningfully constrains who can exploit this.

This is a genuine but conditional priority, not an overhyped high-CVSS finding. The CVSS 4.0 score of 7.1 (High) reflects an adjacent attack vector (AV:A), low complexity (AC:L), no privileges (PR:N), and high availability impact to the vulnerable system (VA:H) with low subsequent-system availability impact (SA:L) - consistent with an RPD crash that disrupts routing/traffic until reconvergence. The vector also encodes AU:Y (automatable) and R:A (automatic recovery, since RPD restarts on its own), meaning a single crafted update reliably triggers the condition but the daemon self-heals, so impact is a transient-but-repeatable outage rather than permanent compromise. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation status is: no public exploit identified at time of analysis. The decisive mitigating signal is PR:N being technically true yet practically gated - exploitation requires an already-established BGP session with the target and a BGP traffic-engineering configuration, so the realistic attacker is a BGP peer or someone who can inject into an existing session, not an arbitrary internet host. There are no conflicting signals: the adjacent vector and the 'established BGP session' precondition in the description agree. Treat as a priority patch for operators running BGP TE, lower priority for devices without BGP TE configured.

An attacker positioned as (or able to inject into) an established BGP peer of a Junos device running a traffic-engineering configuration sends a single specific, valid, optional non-transitive BGP update over the session. RPD parses the disallowed input, crashes, and automatically restarts, dropping routing adjacencies and disrupting traffic until the network reconverges. No public exploit code was identified at time of analysis, and the attack is automatable (AU:Y), so it can be repeated to cause sustained flapping.