Juniper's 14 October bulletin fixes Junos OS and Evolved vulnerabilities, including nine CVSS 3.1 critical records. Its statement, checked on 17 October, reports no known exploitation. That describes vendor awareness, not proof that attacks have never occurred. Use its complete fix matrix: family suffixes and the 23.2, 23.4 and 24.2 respins matter. Affected 23.4X100-EVO has no same-train fix listed. EOE/EOL releases are unevaluated; no workaround covers every issue. Find the relevant path J-Web: CVE-2026-101983, CVE-2026-101986, CVE-2026-101954. BGP, EVPN and FlowSpec: CVE-2026-101990, CVE-2026-101982, CVE-2026-102178. Service deployment: CVE-2026-102175. BMP: CVE-2026-33796, CVE-2026-33789. These linked records distinguish prerequisites, impacts, affected ranges and issue-specific mitigations. The shortlist does not cover the bulletin's lower-rated issues. Give the window a way to fail safely Our proposed runbook separates three decisions: which asset to handle first, which image to approve and what evidence would justify continuing after each stage. Put a named decision-maker beside each one. A signed change ticket is not the same thing as an observed working service. Before starting, keep the current configuration and image details, an independent recovery route and explicit stop criteria. Agree who can pause the work if the expected result does not appear. For a redundant pair, write down the intended roles and order rather than assuming a second member will cover an unplanned interruption. Capture the working service before the change: neighbour relationships, installed routes, management access, alarms and redundancy state. After each stage, compare those same observations and check the actual running image on every member. Record discrepancies before…