CVE-2026-102035: CWE-617 Reachable Assertion in Juniper Networks Junos OS

This vulnerability (CVE-2026-102035) involves a reachable assertion flaw in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved. An adjacent attacker can exploit this flaw by sending a crafted ICCP peer message when MC-LAG IRB MAC synchronization is enabled, resulting in a denial of service condition. The vulnerability affects a broad range of Junos OS versions and their Evolved counterparts, as detailed in the affectedVersions field. The CVSS 3.1 vector indicates the attack requires adjacent network access, has low attack complexity, no privileges or user interaction needed, and impacts availability without affecting confidentiality or integrity.

Successful exploitation leads to denial of service (DoS) by triggering an assertion failure in the l2ald process, potentially disrupting network operations on affected Junos OS devices. There is no impact on confidentiality or integrity according to the CVSS vector. The attack requires adjacency to the target network segment and no privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling MC-LAG IRB MAC synchronization if feasible or restricting adjacency access to trusted entities to reduce exposure.