XML Injection Vulnerability in Juniper Networks Junos OS on SRX Series Devices
CVE-2026-102037

9.2CRITICAL

Key Information:

Vendor

Juniper Networks
Status
Junos Os
Vendor
CVE Published:
14 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-102037?

An XML Injection vulnerability exists in the Unified Threat Management daemon (utmd) of Juniper Networks' Junos OS. This flaw permits an unauthenticated network attacker to manipulate device configurations with root privileges by exploiting a malicious response from a custom URL-feed server. It poses significant risks to network integrity and device control, making it critical for organizations to address this issue promptly.

Affected Version(s)

Junos OS 23.4 < 23.4R2-S8.13

Junos OS 24.2 < 24.2R2-S5.5

Junos OS 24.4 < 24.4R2-S5

References

https://supportportal.juniper.net/JSA112186
vendor-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.