EUVD-2026-101493
GHSA-mjrv-f2hg-pqg8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAbuse configured BGP ISO-VPN peering session
-
DeliverySend crafted inconsistent ISO-VPN update
-
ExploitBMP/NSR processes malformed route data
-
Executionrpd validation fails and daemon crashes
-
ImpactRouting disrupted (denial of service)
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires that (1) the target Junos OS or Junos OS Evolved device is explicitly configured with a BGP ISO-VPN (CLNS/IS-IS L3VPN) peering session with the attacker-controlled peer, and (2) that the crafted ISO-VPN update is processed by either BMP (BGP Monitoring Protocol) route monitoring or NSR (Nonstop Active Routing). Devices without ISO-VPN configured, or with ISO-VPN but neither BMP route monitoring nor NSR enabled, are not exposed. The key limiting factor is the required pre-established peering trust relationship - the attacker must be an accepted BGP ISO-VPN neighbor - which narrows realistic exploitation to compromised or malicious peers rather than arbitrary internet hosts, even though no device-level authentication (PR) is involved. |
| Impact | This is a genuine high-severity availability risk but with meaningful exploitation gating. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with VA:H and SA:L yields 8.7, driven entirely by availability impact - there is no confidentiality or integrity exposure (VC:N/VI:N). The score's PR:N is technically accurate for device authentication, but the description makes clear the attacker must already be a CONFIGURED BGP ISO-VPN peer, i.e. the victim device must be deliberately configured to peer with the attacker, which is a substantial trust precondition not reflected in the raw vector - verify against your actual peering topology before treating this as internet-wide unauthenticated. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploitation signal: no public exploit identified at time of analysis. The practical priority is moderate-to-high for service providers running ISO-VPN (CLNS/IS-IS VPN) with BMP route monitoring or NSR enabled, and low for the large majority of Junos deployments that do not use ISO-VPN. Net: a real crash bug worth patching on exposed route reflectors/PE routers, but not a drop-everything internet-facing issue given the required peering and feature configuration. |
| Exploit ScenarioDerived | An attacker who controls a device that the target Junos/Junos OS Evolved router is configured to peer with over BGP ISO-VPN sends a specially crafted ISO-VPN update. When the router's rpd processes that update through BMP route monitoring or Nonstop Active Routing (NSR), an input-consistency validation flaw causes rpd to crash, disrupting routing. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Denial of service in Juniper Networks Junos OS and Junos OS Evolved: a malformed BGP ISO-VPN (CLNS/IS-IS L3VPN) update from an accepted ISO-VPN peer crashes the routing protocol daemon (rpd) when that update is subsequently handled by BMP route monitoring or by NSR replication, taking down routing on the affected device (CVSS 4.0 base 8.7; AV:N/AC:L/AT:N/PR:N/UI:N with VA:H and SA:L). Exploitation requires no credentials on the wire, but it is gated by a pre-established BGP ISO-VPN peering relationship, so realistic exposure is limited to compromised or malicious peers rather than arbitrary internet hosts, and the device must additionally have BMP route monitoring or NSR enabled. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; exploitation yields only availability impact, with no confidentiality or integrity loss on the router itself.
RemediationAI
The source data does not include a fixed version number, so patch availability cannot be independently confirmed here - consult Juniper advisory JSA112187 (https://supportportal.juniper.net/JSA112187) for the exact Junos OS and Junos OS Evolved releases that correct the rpd ISO-VPN consistency check, and upgrade to the prescribed maintenance release on the affected train; since the underlying defect is in how rpd consumes ISO-VPN updates, no configuration change can fully substitute for that fix. Until the patched release is deployed, prioritize compensating controls that shrink the reachable attack surface. First, disable ISO-VPN (remove the BGP ISO-VPN family/peering configuration) if IS-IS L3VPN reachability over BGP is not operationally required - the trade-off is loss of that service, but it eliminates the vulnerable code path entirely. Second, if ISO-VPN must remain, remove the downstream replication trigger: turn off BMP route monitoring for the relevant BGP sessions, or disable NSR (nonstop-routing) on the routing engine - either step prevents the inconsistent update from reaching the crashing path, at the cost of losing route-monitoring visibility to collectors or losing hitless RE failover/redundancy respectively. Third, harden the peer population, since the attacker must already be an accepted ISO-VPN neighbor: restrict ISO-VPN peering to explicitly trusted peers, apply import policy that filters ISO-VPN NLRIs from untrusted neighbors, and enable BGP TCP-MD5/TCP-AO and generalized TTL security (GTSM) to make session hijacking by an off-path attacker harder - these do nothing against a genuinely malicious or already-compromised peer. Finally, monitor for rpd core dumps and unexpected routing-engine failovers as a detection signal, and treat any rpd restart on a device running ISO-VPN with BMP or NSR as a potential exploitation attempt.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is improper validation of consistency within input - the class of defects in which a parser accepts a message whose internal fields or attribute/ NLRI combinations are mutually inconsistent, deferring the failure to a downstream consumer that assumes consistency. Here the affected component is rpd, the Junos routing protocol daemon, and the input vector is the BGP ISO-VPN address family, the address family used to carry ISO/CLNS (IS-IS) reachability across a Layer 3 VPN. A specifically crafted ISO-VPN update is accepted and stored by the main BGP path, but when the same update is replayed or replicated onto a secondary processing path - BGP Monitoring Protocol (BMP) route monitoring, which streams Adj-RIB-In/route-monitoring copies to a collector, or Nonstop Active Routing (NSR), which checkpoints routing state between REs for hitless failover - the inconsistency is not tolerated and rpd aborts. The dual trigger condition explains the oddly asymmetric scored vector (affected system availability high, subsequent system availability low): the crash is local to the device, while the knock-on effect is loss of the monitoring feed or of NSR-protected redundancy. Adjacent protocols and neighboring devices are not implicated; the weakness is confined to rpd's ISO-VPN handling under BMP/NSR replication, and no CWE identifier was supplied in the source data.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Availability-only rpd crash (A:H, C:N/I:N) reachable over the network from a configured BGP ISO-VPN peer with no device authentication, hence PR:N and AC:L despite the peering/feature precondition.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is then processed by BMP route monitoring or NSR.
Executive ViewAI
A high-severity availability issue affects Juniper Networks Junos OS and Junos OS Evolved routers that use BGP ISO-VPN peering and either BMP route monitoring or NSR replication. A malformed update from an established ISO-VPN peer can crash the routing protocol daemon and cause routing outages, potentially disrupting connectivity for customers, partners, and internal operations. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis, so leadership should prioritize exposure assessment and interim mitigations for business-critical routing infrastructure.
No vendor-released patch identified at time of analysis; interim mitigations include disabling BMP route monitoring or NSR replication on affected Juniper Networks Junos OS and Junos OS Evolved devices where operationally feasible, restricting BGP ISO-VPN peering to trusted peers, monitoring for rpd crashes, and maintaining redundant routing paths.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB