CVE-2026-102064

Executive Summary

CVE-2026-102064 is a reachable assertion vulnerability (CWE-617) in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An attacker can trigger a daemon crash by sending malformed BGP MCAST-VPN updates from a configured eBGP peer, resulting in denial of service of the routing process. Any organization operating Junos-based routing platforms that peer via eBGP with untrusted or partially trusted external networks is potentially affected.

Technical Analysis

The vulnerability resides within the routing protocol daemon (rpd), the Junos component responsible for all routing protocol processing including BGP. The root cause is classified as CWE-617 (Reachable Assertion), which means the daemon contains an assertion or invariant check that, under specific malformed input conditions, evaluates to a failing state and causes an immediate process termination rather than a recoverable error.

The trigger condition is specifically malformed BGP MCAST-VPN updates received from a configured eBGP peer. BGP MCAST-VPN is the Multiprotocol BGP address family used to distribute multicast VPN routing information (characterized by the MCAST-VPN subsequent address family identifier, SAFI 5, under the MP-BGP framework defined in RFC 6514). The rpd processes these MP_REACH_NLRI or MP_UNREACH_NLRI path attributes carrying MCAST-VPN network layer reachability information. A malformed update — one that violates an internal consistency expectation, such as an unexpected field length, an inconsistent route distinguisher/prefix combination, or an out-of-range value within the MCAST-VPN NLRI — reaches an assertion that is not defensively handled, terminating rpd.

Because the assertion is "reachable," the code path can be exercised by a remote peer with a valid eBGP session and no special privileges or credentials beyond an established BGP adjacency. The attack surface is therefore the BGP control plane, specifically the MCAST-VPN address family, exposed on TCP port 179.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (score 7.5) reflects network-reachable, low-complexity exploitation requiring no privileges and no user interaction, with the sole impact being high availability (the rpd crash). Confidentiality and integrity impacts are none, and scope is unchanged.

Specific affected Junos OS version ranges, exact assertion location, and the precise malformed field are not disclosed in the available data. No public proof-of-concept or exploit code is known at this time. No Nuclei template exists.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (reachable assertion triggered by malformed BGP MCAST-VPN updates) and the data provided. It is described at the vulnerability-class level without fabricating implementation details.

1. Reconnaissance / target identification: The attacker identifies a target Juniper device running Junos OS / Junos OS Evolved that acts as a BGP speaker and is reachable over TCP/179. This requires the attacker to have or obtain a configured eBGP peering relationship with the target — for example, an upstream provider, a route server, a peer, or any external autonomous system with an established eBGP session to the victim.

2. Triggering the flaw class: Having established (or possessing) a valid eBGP session, the attacker crafts a BGP UPDATE message for the MCAST-VPN address family containing malformed MCAST-VPN network layer reachability information. The malformation is designed to violate an internal invariant enforced by an assertion in rpd. The malformed update is advertised to the victim across the established session.

3. Payload / execution method (class level): The payload is a protocol-conformant-enough BGP UPDATE for MCAST-VPN that passes the BGP message framing and capability negotiation but contains malformed AFI/SAFI-specific NLRI or attribute contents. On receipt and parsing by rpd, the malformed data reaches the unhandled assertion, causing rpd to abort.

4. Post-exploitation impact: The immediate result is termination of the routing protocol daemon. Depending on platform configuration and daemon supervision behavior, this can disrupt routing (BGP session resets, routing information loss, possible forwarding-plane impact during reconvergence) and can be repeated to sustain a denial-of-service condition. There is no indication of code execution, data disclosure, or integrity compromise.

Impact Assessment

The primary impact is availability. Per CVSS:3.1, Availability is rated High (A:H); Confidentiality and Integrity are None (C:N/I:N/A). The attack is network-based (AV:N), low complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N), with unchanged scope (S:U). Base score 7.5 (High).

Blast radius: Affected systems are Juniper routing platforms running vulnerable Junos OS / Junos OS Evolved releases that (a) run the routing protocol daemon and (b) have a configured eBGP session in which MCAST-VPN (multicast VPN) routing information may be exchanged. Environments using MVPN / multicast VPN services over eBGP, service provider edges, and any network that peers BGP with external or less-trusted parties are most exposed. Because rpd is central to routing, a crash can cause route flapping, session teardown, and intermittent forwarding disruption until the daemon restarts and protocols reconverge. Repeated exploitation can produce sustained instability. No data breach or permanent device compromise is expected from this flaw alone.

The EPSS score is not yet available from FIRST.org; no exploit-in-the-wild evidence and no CISA KEV listing are associated. As exploitation requires an already-established eBGP peering relationship, the practical attack surface is limited to parties that can form or influence such a session — external peers, upstreams, or an attacker positioned to inject traffic into the BGP session.

Detection Guidance

Sigma Rule

title: Junos rpd Reachable Assertion via Malformed BGP MCAST-VPN Update
id: 7c1a2f04-9b6d-4e21-aa53-jun2026mcastvpn
status: experimental
description: Detects rpd crash/restart events on Juniper Junos consistent with CVE-2026-102064 (malformed BGP MCAST-VPN updates causing reachable assertion).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102064
author: valtersit.com
date: 2026/01/01
logsource:
  product: juniper
  service: junos
detection:
  selection_rpd:
    - 'rpd\[\d+\].*Assertion failed'
    - 'rpd\[\d+\].*abort'
    - 'rpd\[\d+\].*core'
    - 'routing protocol daemon.*crash'
  selection_bgp:
    - 'BGP.*UPDATE'
    - 'MCAST-VPN'
    - 'SAFI 5'
  condition: selection_rpd
fields:
  - process
  - message
level: high
tags:
  - attack.t1190
  - cve.2026.102064

YARA Rule

rule CVE_2026_102064_Junos_rpd_MCASTVPN_Assertion
{
    meta:
        description = "Detects Junos rpd assertion/crash strings associated with CVE-2026-102064 (malformed BGP MCAST-VPN update)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102064"
        date = "2026-01-01"
        severity = "high"

    strings:
        $a = "rpd" ascii wide nocase
        $b = "assertion failed" ascii wide nocase
        $c = "MCAST-VPN" ascii wide nocase
        $d = "mcast-vpn" ascii wide nocase
        $e = "SAFI 5" ascii wide nocase

    condition:
        $a and $b and 1 of ($c, $d, $e)
}

Suricata IDS Rule

alert tcp any any -> any 179 (msg:"CVE-2026-102064 Juniper Junos BGP MCAST-VPN potential malformed update (MP-BGP SAFI 5)"; flow:established,to_server; content:"|FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF|"; depth:16; content:"|02|"; within:1; content:"|00 05|"; within:32; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-dos; reference:cve,2026-102064; sid:2026102064; rev:1;)

Note: BGP UPDATE messages use the 16-byte all-ones marker followed by the 2-byte length and 1-byte type (0x02 for UPDATE). This rule is a heuristic; SAFI 5 (MCAST-VPN) appears within the MP_REACH/MP_UNREACH attribute and is matched here within the message window. Tuning is required to reduce false positives.

Elastic Detection

process where event.category == "process"
  and process.name == "rpd"
  and process.command_line : ("*abort*" or "*assert*")
  and message : ("MCAST-VPN" or "SAFI 5" or "UPDATE")

routing.* where destination.port == 179
  and network.transport == "tcp"
  and bgp.afi_safi == "mcast-vpn"
  and event.action : ("malformed*" or "parse-error*")

Splunk SPL Query

index=network sourcetype=juniper:junos OR sourcetype=syslog
| search ("rpd" AND ("Assertion failed" OR "abort" OR "core" OR "crash"))
    OR ("BGP" AND ("MCAST-VPN" OR "SAFI 5" OR "malformed update"))
| eval severity=if(match(_raw,"(?i)assertion failed|abort|crash"),"high","medium")
| stats count min(_time) as first_seen max(_time) as last_seen values(_raw) as events
    by host severity
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="juniper,junos,cve-2026-102064,">
  <rule id="100264" level="12">
    <decoded_as>syslog</decoded_as>
    <match>rpd</match>
    <regex>Assertion failed|abort|dumped core|routing protocol daemon.*crash</regex>
    <description>CVE-2026-102064: Junos rpd reachable assertion / crash (possible malformed BGP MCAST-VPN update)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>availability,denial_of_service,bgp,</group>
  </rule>

  <rule id="100265" level="8">
    <decoded_as>syslog</decoded_as>
    <match>BGP</match>
    <regex>MCAST-VPN|SAFI 5|malformed.*update</regex>
    <description>CVE-2026-102064: Suspicious BGP MCAST-VPN activity from peer</description>
    <group>bgp,recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list is available in the provided data. The guidance below is class-level and should be validated against official vendor advisories.

1. Immediate mitigations

• Reduce exposure of the BGP control plane: restrict TCP/179 connectivity so that only trusted, authenticated peers can establish sessions; apply inbound/outbound filters and TTL/ACL protections on BGP peers.
• Review eBGP peering policy. If MCAST-VPN / MVPN (SAFI 5) is not operationally required on a given session, avoid advertising or accepting the MCAST-VPN address family where the software permits per-family policy controls.
• Harden BGP against malformed input: enable route-flap damping, set BGP maximum-prefix limits, and apply inbound prefix/attribute validation on all eBGP sessions.
• Increase resiliency: ensure rpd supervision/restart behavior is configured so that a crash does not cascade to broader outages, and monitor for rpd restart events.
• Limit who can peer: apply MD5/TCP-AO or other session protection so that only intended peers can deliver UPDATEs.

2. Patch / upgrade steps

• No patch is identified at this time. Monitor Juniper Networks official security advisories and the Juniper SIRT (Security Incident Response Team) channels for the assigned Junos OS and Junos OS Evolved fixed releases, then upgrade to the fixed release once published.
• Because no affected-version data is available, consult the vendor advisory to determine whether your running release is in scope before planning maintenance.

3. Long-term hardening

• Adopt RPKI / BGP origin validation (ROV) and route filtering as baseline hygiene on all external peering.
• Segment routing control plane reachability; treat every eBGP peer as untrusted input.
• Maintain an inventory of BGP address families (including MCAST-VPN/MVPN) enabled per session and disable unused families.
• Continuously monitor vendor advisories for this CVE and track the eventual patch to close the loop.

References

• NVD — CVE-2026-102064: https://nvd.nist.gov/vuln/detail/CVE-2026-102064
• MITRE CWE-617 (Reachable Assertion): https://cwe.mitre.org/data/definitions/617.html
• Juniper Networks Security Advisories (Juniper SIRT): https://supportportal.juniper.net/s/ (consult for the CVE-specific advisory and fixed releases)
• RFC 6514 — BGP Encodings and Procedures for Multicast in MPLS/BGP IP VPNs (MCAST-VPN / SAFI 5 context): https://www.rfc-editor.org/rfc/rfc6514
• FIRST EPSS — not yet scored (CVE-2026-102064); CISA KEV — not listed.

No threat-actor campaign or exploit-in-the-wild evidence is associated with CVE-2026-102064 at the time of writing. No public PoC or exploit code is known.