Juniper Junos OS EUVD-2026-101479

Exploitation requires that the target Junos OS / Junos OS Evolved device be running the BGP routing protocol with VPLS signaling enabled, and that the attacker be a CONFIGURED BGP peer of that device - meaning an established peering/trust relationship must already exist. The malicious trigger is a crafted BGP VPLS signaling update sent over that session. Limiting factors: the adjacent attack vector (AV:A) and the configured-peer prerequisite confine exploitation to devices that peer with the attacker (e.g. a malicious, misconfigured, or compromised peer), so devices with no VPLS signaling configuration or no untrusted BGP peers are not exposed; impact is limited to denial of service (rpd crash) with no confidentiality or integrity loss.

This is a genuine but bounded operational risk rather than an urgent emergency. The Juniper-assigned CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) scores 7.1 and reflects a pure availability impact (VA:H, with SA:L on subsequent systems; VC/VI/VA for confidentiality and integrity are N). The adjacent attack vector (AV:A) is the single most important limiter: exploitation is not internet-wide but requires the attacker to already be a configured BGP peer of the target, i.e. a pre-existing routing trust relationship. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation. No SSVC decision record was provided. The signals are internally consistent - a high-but-not-critical score, availability-only impact, and a trust-gated attack surface - so this reads as a real patch-management priority for operators running BGP VPLS signaling with external or lower-trust peers, but not a drop-everything issue for networks without that exposure. One nuance to verify: although CVSS marks PR:N (no system authentication), the description's 'configured BGP peer' prerequisite is a meaningful real-world access barrier not captured by the base metrics.

An attacker who controls or has compromised a device that is an established BGP peer of a Junos OS / Junos OS Evolved router sends a malformed BGP VPLS signaling update across the session. The improper input validation in the rpd process causes rpd to crash, disrupting routing on the target until the daemon restarts. No public proof-of-concept is known, and the adjacent (AV:A) vector means the attacker must already sit in the BGP peering relationship.