CVE-2026-102070: CWE-617 Reachable Assertion in Juniper Networks Junos OS

CVE-2026-102070 is a reachable assertion vulnerability (CWE-617) in the TWAMP client component of Juniper Networks Junos OS. An unauthenticated attacker can send a crafted TCP packet to trigger an assertion failure in the rmopd service, causing it to disrupt and potentially deny service. The vulnerability affects multiple version ranges of Junos OS, specifically versions >=0 and less than 23.2R2-S7.7, >=23.4 and less than 23.4R2-S8.13, >=24.2 and less than 24.2R2-S5.5, >=24.4 and less than 24.4R2-S5, >=25.2 and less than 25.2R2-S2, >=25.4 and less than 25.4R1-S3, and >=26.2 and less than 26.2R1-S2. The CVSS v3.1 score is 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, but high impact on availability. No vendor advisory or patch information is provided in the input, so remediation status is unknown.

The vulnerability allows an unauthenticated remote attacker to cause disruption of the rmopd service in Junos OS by sending a specially crafted TCP packet. This results in denial of service (DoS) impacting availability. There is no impact on confidentiality or integrity. No known exploits are reported in the wild, but the high CVSS score reflects the potential for significant service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is confirmed, network administrators should consider restricting access to the TWAMP client service or monitoring for unusual TCP packets targeting this service to reduce exposure. No vendor-provided patches or official fixes are referenced in the provided data.