Juniper Junos OS EUVD-2026-101480

Exploitation requires the attacker to be a configured BGP peer of the target router (an existing peering/trust relationship), and the device must be configured such that the malicious flow-spec route is selected for re-advertisement - i.e., flow-spec routes are received and propagated. Remote code execution is only possible on Junos OS; Junos OS Evolved is limited to an rpd crash (denial of service). Limiting factors that reduce real-world risk: no exploitation is possible without an established BGP session, so routers peering only with trusted/internal neighbors are far less exposed than those with external or internet-facing peers; the specific flow-spec re-advertisement configuration must be present.

This is rated Critical (CVSS 4.0 base 9.3) with a vector of AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, which on its face implies trivial remote, unauthenticated, low-complexity exploitation. However, the description materially qualifies this: the attacker must be a 'remote configured BGP peer,' meaning exploitation requires an already-established BGP peering/trust relationship with the target - a precondition the PR:N metric does not capture. This gap should be verified: CVSS scores it as no-privileges-required, but in practice the attack surface is limited to configured BGP peers or an adversary able to inject into/hijack an existing peering session. No EPSS score, CISA KEV listing, or public POC was provided in the source data, so there is no evidence of active or at-scale exploitation at time of analysis - treat the critical score as a worst-case capability (remote code execution) rather than confirmed in-the-wild activity. Impact asymmetry also matters: RCE is only achievable on Junos OS, while Junos OS Evolved is limited to an rpd crash (denial of service). Net: a genuine high priority for operators exposing BGP to untrusted or internet-facing peers, but lower practical risk for deployments where all BGP peers are trusted/internal.

An attacker who is (or has compromised) a configured BGP peer of a Juniper router sends a specially crafted flow-spec update that the target selects for re-advertisement, triggering a stack-based buffer overflow in the routing protocol daemon (rpd). On Junos OS this can lead to remote code execution in the rpd context; on Junos OS Evolved it crashes rpd, disrupting routing. No public exploit code was identified in the provided intelligence.