Junos OS EUVD-2026-101475

Exploitation requires (1) the target router to have BGP multicast-VPN (MCAST-VPN / MVPN address family) configured and active, and (2) the attacker to send the malicious update from a CONFIGURED eBGP peer - i.e., an existing external BGP peering relationship must be in place, or the attacker must be able to inject the malformed MCAST-VPN update into such a session. These are the concrete limiting factors: although CVSS rates PR:N (no authentication to the device itself), the need for a pre-established eBGP peering and an MVPN-enabled configuration restricts the realistic attacker set to peering/adjacent networks and to routers running multicast VPN, not the general Internet. No user interaction is needed and attack complexity is low once those conditions are met.

This is a credible operational priority for networks running affected Junos OS / Junos OS Evolved, but its real-world exploitability is gated by a specific precondition. The Juniper-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 and portrays a network-reachable, low-complexity, no-privilege, no-interaction attack whose only impact is availability (VA:H, plus SA:L on subsequent systems reflecting routing-plane disruption). The CWE-617 Reachable Assertion confirms the outcome is a controlled rpd crash rather than code execution - there is NO confidentiality or integrity impact (VC:N/VI:N). The key tension is between PR:N and the description's stated requirement that the malformed BGP MCAST-VPN update originate 'from a configured eBGP peer': the attacker does not need credentials on the device, but DOES need an established eBGP peering relationship (or the ability to inject updates into one), which meaningfully narrows the attacker population to adjacent/peering networks rather than the arbitrary Internet. No EPSS score, KEV listing, or POC was provided in the input, so exploitation probability cannot be quantified from the data. Net: treat as a high-severity availability/DoS issue worth prompt patching on BGP-facing routers, but not an Internet-wide drive-by - exposure depends on existing eBGP peerings and MVPN configuration.

An attacker who controls or can inject into a configured eBGP peering session sends a malformed BGP MCAST-VPN (multicast VPN) update to a vulnerable Junos OS / Junos OS Evolved router, triggering a reachable assertion in the routing protocol daemon (rpd). The daemon crashes, dropping routing adjacencies and disrupting packet forwarding until it restarts; repeated updates can sustain the outage. No public exploit identified at time of analysis, and low attack complexity (AC:L) means a single crafted update suffices once peering exists.