Juniper Junos OS EUVD-2026-101464

Exploitation requires a very specific deployment: an MX Series device must be equipped with an SCBE3 Switch Control Board AND be configured to participate in SyncE or Precision Time Protocol (PTP) clock synchronization with an upstream timing node. The attacker must be logically adjacent - positioned as (or in control of) that upstream SyncE/PTP node so it can deliver a malformed synchronization message into the victim's clock path; there is no remote/internet-facing exploitation path (CVSS AV:A). Key limiting factors: no authentication is required (PR:N), but triggering depends on a race condition that Juniper states is 'outside the attacker's direct control' (reflected as AC:H), so successful DoS is non-deterministic and cannot be reliably forced. Devices without SCBE3, or not running SyncE/PTP, are not affected.

This is a genuine but modest-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.3 MEDIUM) is internally consistent with the description: adjacency (AV:A) matches the requirement that an upstream SyncE/PTP node send the malformed message, high complexity (AC:H) matches Juniper's own statement that triggering is a race condition 'outside the attacker's direct control,' and the impact is availability-only (A:H, C:N/I:N) matching the clksyncd crash and persistent RE switchovers. No EPSS score, KEV entry, or POC was provided in the input; per the precision rules this means no public exploit is identified and there is no evidence of active exploitation. The combination of AC:H plus the explicit race-condition caveat means reliable, attacker-controlled triggering is unlikely, which tempers the A:H impact - real-world exploitability is opportunistic rather than deterministic. Missing signals to note explicitly: EPSS probability is absent (cannot quantify likelihood), and KEV/POC status is unconfirmed rather than confirmed-negative. The adjacency requirement further confines the threat to an attacker already positioned on the clock-synchronization path, so this is a localized availability risk for operators running the specific vulnerable configuration rather than a broadly exploitable flaw.

An attacker who controls or has compromised a SyncE or PTP upstream timing node sends a malformed synchronization message to a downstream MX Series device equipped with an SCBE3 card. The malformed input triggers a false 19.44MHz alarm on the master Routing Engine, causing persistent RE switchovers and a crash of the clksyncd process, resulting in denial of service. No public exploit code is identified at time of analysis, and because triggering depends on a race condition the attacker cannot reliably control timing (CVSS AC:H).