The vulnerability is an improper validation of consistency within input data processed by the routing protocol daemon (rpd) (CWE‑1284). A BGP ISO‑VPN peer can send a specially crafted ISO‑VPN update. When BMP route monitoring or NSR is enabled, the daemon misparses the update, causing a crash. This results in loss of routing service and can disrupt network connectivity for all traffic that depends on the affected device.

Juniper Networks products Junos OS and Junos OS Evolved are affected. Versions susceptible include the Junos OS releases 21.2R3‑S11, 21.4R3‑S12, 22.2R3‑S8, 22.3R3‑S5, 22.4R3‑S9, 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all subsequent releases. Junos OS Evolved versions 23.2R2‑S7‑EVO, 23.4R2‑S8‑EVO, 24.2R2‑S5‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all subsequent releases are affected. If your device is running an earlier version of any of the listed releases, it has been rebuilt with a respin that addresses this issue.

The CVSS score of 8.7 categorizes the vulnerability as high severity. The EPSS score is <1%, indicating a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed public exploitation. The likely attack scenario requires an attacker to establish a BGP session with a properly configured ISO‑VPN peer on a device that has BMP or NSR enabled. The crafted ISO‑VPN update causes the rpd daemon to crash, leading to a denial of routing functionality for all traffic that traverses the device.