CVE-2026-102062

Received Received - Intake

Use of Externally-Controlled Format String in Juniper Junos OS SRX Series

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Juniper Networks, Inc.

Description

An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a compromised or impersonated configured HTTPS feed server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102062

EUVD

EUVD-2026-101467

Affected Vendors & Products

Vendor	Product	Version / Range
Juniper	Networks	Junos OS 0
Juniper	Networks	Junos OS 23.4
Juniper	Networks	Junos OS 24.2
Juniper	Networks	Junos OS 24.4
Juniper	Networks	Junos OS 25.2
Juniper	Networks	Junos OS 25.4
Juniper	Networks	Junos OS 26.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-134	The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Attack-Flow Graph

Executive Summary

This vulnerability is a Use of Externally-Controlled Format String issue in the ipfd daemon of Juniper Networks Junos OS on SRX Series. An unauthenticated network-based attacker can exploit it by compromising or impersonating a configured HTTPS feed server to execute code with root privileges.

Impact Analysis

An attacker could gain full control over affected Juniper SRX Series devices, leading to unauthorized access, data theft, or disruption of network services. This could compromise network security and integrity.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating compliance requirements for GDPR, HIPAA, and other regulations. Organizations may face legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update Junos OS on SRX Series devices to the latest patched version to address the ipfd daemon vulnerability. Disable or restrict access to HTTPS feed servers until they are verified as secure. Monitor network traffic for suspicious activity targeting the ipfd daemon.

Hi! I’m here to help you understand CVE-2026-102062. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70