CVE-2026-102037
8.1HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-91
Impact
An unauthenticated network attacker can execute arbitrary configuration changes with root privileges on the device. To exploit this, the attacker must be able to return a malicious response from a configured custom URL-feed server.
Root cause
Improper XML neutralization (XML injection) in the Unified Threat Management daemon (utmd) when parsing responses from custom URL-feed servers.
Affected systems
Juniper Networks Junos OS on SRX Series devices; specific version ranges are not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to the fixed Junos OS release referenced in Juniper advisory JSA112186. As an interim workaround, disable custom URL-feed server updates or restrict custom feed sources to trusted networks.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via a malicious response from a configured custom URL-feed server.