CVE-2026-102037 — Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used

CVE-2026-102037

Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used PUBLISHED

Description (CNA)

An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via a malicious response from a configured custom URL-feed server.

Affected (CNA)

Vendor / product	Versions
Juniper Networks / Junos OS	affected 23.4 before 23.4R2-S8.13; affected 24.2 before 24.2R2-S5.5; affected 24.4 before 24.4R2-S5; affected 25.2 before 25.2R2-S2; affected 25.4 before 25.4R1-S3; affected 26.2 before 26.2R1-S2

CWE

CWE-91

References

https://supportportal.juniper.net/JSA112186

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.