CVE-2026-102044

Executive Summary

CVE-2026-102044 is a reachable assertion (CWE-617) vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An attacker who is already established as a configured BGP-Link State (BGP-LS) peer can send a crafted BGP-LS update that triggers an assertion failure, causing the rpd process to abort and inflicting a denial-of-service condition on the routing control plane. The vulnerability is network-reachable, requires no privileges or user interaction (CVSS 3.1 base 7.5), and no patch or public exploit currently exists.

Technical Analysis

The vulnerability resides in the Juniper rpd process, the daemon responsible for routing protocol operation including BGP and its address-family extensions. The fault class is a reachable assertion (CWE-617): a condition that the code asserts must never occur is reachable by processing attacker-supplied input. Specifically, the NVD description states that a configured BGP-LS peer can cause a denial of service "via a BGP-LS update."

BGP-LS (Border Gateway Protocol - Link State) is a BGP address family used to distribute link-state and traffic-engineering topology information from an IGP to external consumers such as a controller (e.g., a Path Computation Element or SDN controller). A BGP-LS speaker accepts Network Layer Reachability Information (NLRI) carrying link, node, and prefix descriptors plus associated attributes. When rpd parses a malformed or semantically invalid BGP-LS update, an internal invariant check fails, the assertion fires, and the process terminates.

Key technical facts that are derivable from the provided data:

• The attack surface is the BGP-LS control-plane session. Reachability requires a valid, established BGP session with the BGP-LS address family negotiated (i.e., the attacker must be a "configured BGP-LS peer").
• The failure mode is an assertion abort, not memory corruption — this is consistent with CWE-617 and with the CVSS Impact vector of Availability:High with Confidentiality:None and Integrity:None.
• Because rpd is the routing control plane, its termination can disrupt routing adjacencies, protocol convergence, and traffic forwarding, potentially affecting all routing domains the device participates in.

The exact assertion site, the specific BGP-LS NLRI or attribute field that reaches it, and the precise software releases affected are not disclosed in the available data. No code-level path, function name, or message identifier can be confirmed from the description; any such claim would be speculation and is therefore omitted.

Exploitation Scenarios

No public PoC or exploit code exists. The attack chain below is inferred strictly from the NVD description and the vulnerability class.

1. Reconnaissance / target identification. An adversary identifies a Juniper Networks device running Junos OS or Junos OS Evolved that operates as a BGP speaker with BGP-LS configured. Because BGP-LS peerings are typically established between routers and controllers within a trusted routing domain or between autonomous systems by design, the attacker must either (a) already control or compromise a device legitimately authorized to peer via BGP-LS, or (b) be in a position to establish a BGP-LS session the target is configured to accept. BGP generally runs over TCP port 179; the attacker must be able to complete the BGP session establishment (OPEN/KEEPALIVE) for the BGP-LS address family before delivering the malicious update.

2. Triggering the specific flaw class. Having established the BGP-LS session, the attacker transmits a BGP-LS UPDATE message. The malformed or unexpected content causes rpd to evaluate a condition that the code asserts should be impossible; the assertion fails (reachable assertion, CWE-617).

3. Payload / execution method. The delivery vector is a BGP-LS UPDATE carrying crafted NLRI or path attributes. Because the description provides no field-level detail, the exact malformed element cannot be specified here. No memory corruption or code execution is implied by the CWE or CVSS vectors — the outcome is process abort.

4. Post-exploitation impact. The rpd process aborts, causing a denial of service on the routing control plane. This can drop routing adjacencies, interrupt BGP-LS topology distribution to controllers, and disrupt traffic forwarding while the daemon restarts or remains down. Successful exploitation is repeatable: an attacker retaining an accepted BGP-LS session could re-trigger the assertion, sustaining the outage.

Impact Assessment

The CVSS 3.1 base score is 7.5 (High). Subscore analysis:

• Attack Vector: Network (AV:N) — exploitable remotely over the network.
• Attack Complexity: Low (AC:L) — no specialized conditions beyond session establishment.
• Privileges Required: None (PR:N) — no authentication beyond the network-level BGP-LS peering relationship.
• User Interaction: None (UI:N) — no victim action required.
• Scope: Unchanged (S:U) — impact is confined to the vulnerable component's security authority.
• Confidentiality: None (C:N) — no data disclosure.
• Integrity: None (I:N) — no data modification.
• Availability: High (A:H) — total loss of availability within the affected process/service.

Business impact centers on network availability. Affected systems are Juniper Networks platforms running Junos OS and Junos OS Evolved with BGP-LS in use. The blast radius extends beyond the single device: because rpd governs routing adjacencies and topology distribution, an outage can cascade to downstream routing domains, SDN controllers dependent on BGP-LS topology feeds, and any traffic engineered across those paths. Environments that expose BGP-LS sessions to external or semi-trusted peers face the greatest exposure. EPSS is not yet scored by FIRST.org, and the CVE is not listed in CISA KEV; there is no observed exploit-in-the-wild evidence at this time.

Detection Guidance

Sigma Rule

title: Juniper Junos rpd Assertion Failure via BGP-LS Update (CVE-2026-102044)
id: 8f2c1a44-1020-4c04-9b7e-5b6d6f2c1020
status: experimental
description: Detects rpd process crashes/assertion failures on Juniper Junos devices that may indicate exploitation of CVE-2026-102044 via a malformed BGP-LS update.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102044
author: valtersit.com
logsource:
  product: juniper
  service: junos
detection:
  selection_proc:
    process.name: 'rpd'
  selection_event:
    - message|contains: 'rpd'
    - message|contains: 'BGP-LS'
  selection_crash:
    message|contains:
      - 'assertion'
      - 'Assertion'
      - 'core dump'
      - 'process terminated'
      - 'signal 6'
      - 'SIGABRT'
  condition: selection_proc or (selection_event and selection_crash)
falsepositives:
  - Legitimate rpd restarts during maintenance or software upgrades
level: high
tags:
  - attack.t1499
  - cve.2026-102044

YARA Rule

rule CVE_2026_102044_Junos_rpd_BGP_LS_Assertion
{
    meta:
        description = "Detects Junos rpd core dumps or log artifacts referencing BGP-LS assertion failures (CVE-2026-102044)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102044"
        date = "2026-01-01"
    strings:
        $a1 = "rpd" ascii nocase
        $a2 = "BGP-LS" ascii nocase
        $a3 = "assertion" ascii nocase
        $a4 = "Assertion" ascii
        $a5 = "SIGABRT" ascii
        $b1 = "rpd.core" ascii nocase
    condition:
        (2 of ($a*)) or any of ($b*)
}

Suricata IDS Rule

alert tcp any 179 -> any any (msg:"CVE-2026-102044 Juniper Junos rpd BGP-LS assertion DoS attempt"; flow:established,to_client; content:"|FF FF FF FF|"; depth:16; content:"|02|"; within:19; byte_test:2,>,19,16,relative; reference:cve,2026-102044; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102044; classtype:attempted-dos; sid:2026102044; rev:1;)

Elastic Detection

process where process.name == "rpd" and
  (process.exit_code == 134 or
   message like~ "*rpd*assert*" or
   message like~ "*rpd*core*" or
   message like~ "*SIGABRT*")

Splunk SPL Query

index=juniper sourcetype=junos:* (process="rpd" OR message="*rpd*")
(assertion OR "core dump" OR "SIGABRT" OR "signal 6" OR "process terminated" OR "BGP-LS")
| stats count min(_time) as first_seen max(_time) as last_seen by host, message
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="juniper,junos,cve-2026-102044,">
  <rule id="1020440" level="12">
    <decoded_as>json</decoded_as>
    <field name="process">rpd</field>
    <match>assertion|Assertion|core dump|SIGABRT|signal 6|process terminated</match>
    <description>CVE-2026-102044: Juniper Junos rpd assertion failure / crash possibly triggered by malformed BGP-LS update</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict BGP-LS peering to explicitly trusted, individually authenticated neighbors. Apply BGP TCP MD5 / TCP-AO authentication and, where supported, GTSM (TTL security) to make session establishment difficult for unauthorized parties.
   • Use infrastructure ACLs / firewall filters to limit TCP/179 reachability to known peer addresses only, reducing the population of hosts able to reach rpd.
   • Reduce the number of devices configured as BGP-LS peers; disable BGP-LS on devices that do not require it.
   • Monitor rpd process stability; ensure core dumps and abort messages are logged and alerted, and that automatic restart behavior does not mask repeated crashes.
   • Because only already-configured BGP-LS peers can trigger the condition, peer inventory and validation are the primary control.

2. Patch / upgrade steps:

   • No vendor fix is currently tracked. Monitor Juniper Networks security advisories for a Junos OS / Junos OS Evolved release addressing CVE-2026-102044 and schedule an upgrade once available.
   • Validate firmware against Juniper's official advisory channel before deployment; do not rely on unverified third-party mirrors.

3. Long-term hardening:

   • Segment the routing control plane so that no untrusted or lower-trust network can establish a BGP-LS session.
   • Adopt strict BGP peer authentication and route-flap damping policies.
   • Maintain an accurate asset inventory of BGP-LS-capable Juniper devices and their software versions.
   • Incorporate rpd crash telemetry into SIEM correlation to detect exploitation attempts as early warning.

References

1. NVD — CVE-2026-102044: https://nvd.nist.gov/vuln/detail/CVE-2026-102044
2. MITRE CWE-617 — Reachable Assertion: https://cwe.mitre.org/data/definitions/617.html
3. FIRST EPSS — CVE-2026-102044 (not yet scored): https://api.first.org/data/v1/epss?cve=CVE-2026-102044
4. CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of reporting): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. Juniper Networks Security Advisories: https://supportportal.juniper.net/s/global-search/%40uri

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-102044 at the time of writing.