Juniper Junos OS EUVD-2026-101487

Exploitation requires the attacker to already have privileged local access (CVSS PR:H) to a Junos OS or Junos OS Evolved device and the ability to send a crafted packet to the local eventd relay service; it is not remotely reachable (AV:L) and needs no user interaction (UI:N). Limiting factors: the high-privilege prerequisite means the attacker must be an authenticated operator or have an existing foothold, and impact is confined to availability (VA:H, VI/VC:N) - specifically a crash/DoS of the eventd event-processing daemon - with no confidentiality or integrity loss and only a low subsequent-system availability effect (SA:L).

This is a medium-severity, defender-friendly flaw whose signals are largely consistent. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N, VA:H) indicates local access with high privileges already required, no user interaction, and an availability-only impact - this is the dominant limiting factor and keeps the base score at 6.7 (Medium). No EPSS score, CISA KEV listing, or POC was provided in the intelligence, so by the precision rules there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of local-only vector plus PR:H means an attacker must already be an authenticated, privileged operator on the device, which sharply constrains real-world risk: this is not an internet-reachable, unauthenticated RCE but a local DoS that primarily matters as a post-compromise or insider/abuse-of-trust concern. No conflicting signals were detected (the description's 'local attacker' agrees with AV:L). Priority should be routine patching rather than emergency response, with the caveat that network-infrastructure DoS can have outsized operational impact.

An attacker who already holds privileged local access to a Junos OS or Junos OS Evolved device (e.g., a low-trust operator account or a foothold from a prior compromise) sends a specially crafted packet to the local eventd relay service. The malformed input triggers an out-of-bounds write (CWE-787) that crashes eventd, disrupting event/logging processing and causing a denial of service. No public proof-of-concept was identified at the time of analysis, and exploitation requires high privileges and local access.