CVE-2026-101996: CWE-617 Reachable Assertion in Juniper Networks Junos OS

This vulnerability (CVE-2026-101996) involves a reachable assertion failure in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP. An adjacent attacker can trigger a denial of service by sending an inconsistent ICCP peer message, causing the daemon to assert and crash. The issue affects a range of versions prior to specific patch releases across multiple Junos OS and Junos OS Evolved branches. The vulnerability does not impact confidentiality or integrity but results in availability loss. No known exploits are reported in the wild at this time.

The vulnerability allows an adjacent attacker to cause a denial of service by crashing the l2ald daemon through an inconsistent ICCP peer message. This results in loss of availability of affected Junos OS devices configured for MC-LAG/ICCP. There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict adjacency to trusted entities and monitor for anomalous ICCP peer messages to reduce risk. No vendor advisory or patch links are provided in the input data, so verify with Juniper Networks for updates and apply patches promptly once available.