Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.2
CVE-2026-102037: Juniper SRX devices can be reconfigured via custom URL feed
CVE-2026-102037 · published today
Summary
The threat‑feed feature in Junos OS on SRX firewalls can be tricked by a malicious response from the custom URL you configure. An attacker on the network could then change the firewall’s settings as an administrator. Apply the latest Junos OS update or temporarily disable the custom URL‑feed feature until the fix is installed.
What to do
- Update juniper networks junos os to version 23.4R2-S8.13 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| juniper networks | junos os | < 23.4R2-S8.13 |
Original advisory text
Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used
An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via a malicious response from a configured custom URL-feed server.
References
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.2
Critical
Type
CWE-91XML Injection (aka Blind XPath Injection)
Timeline
Published14 Oct 2026
Updated14 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta