CVE-2026-102037
Received
Received - Intake
XML Injection in Juniper Networks Junos OS on SRX Series
Vulnerability report for CVE-2026-102037, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-14
Last updated on: 2026-10-14
Assigner: Juniper Networks, Inc.
Description
Description
An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via a malicious response from a configured custom URL-feed server.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Juniper | Networks | Junos OS 23.4 |
| Juniper | Networks | Junos OS 24.2 |
| Juniper | Networks | Junos OS 24.4 |
| Juniper | Networks | Junos OS 25.2 |
| Juniper | Networks | Junos OS 25.4 |
| Juniper | Networks | Junos OS 26.2 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-91 | The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. |
