Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.2
CVE-2026-102062: Junos OS SRX can run code from fake HTTPS feed
CVE-2026-102062 · published today
Summary
The Junos operating system on SRX devices uses a component that contacts an HTTPS feed server for security information. If that server is compromised or spoofed, an attacker on the network can make the device run any commands with full administrative control, without needing a login. Apply the vendor's security update or disable the external feed feature until the patch is installed.
What to do
- Update juniper networks junos os to version 23.2R2-S7.7 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| juniper networks | junos os | < 23.2R2-S7.7 |
Original advisory text
Junos OS: SRX Series: An compromised HTTPS feed server can cause remote code execution when Security Intelligence is used
An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a compromised or impersonated configured HTTPS feed server.
References
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.2
Critical
Type
CWE-134Use of Externally-Controlled Format String
Timeline
Published14 Oct 2026
Updated14 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta