Junos OS (SRX firewalls)
CVE-2026-102037: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used
An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via a malicious response from a configured custom URL-feed server.
Published Juniper Networks advisory JSA112186
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS 23.4 | 23.4R2-S8.13 or later |
| Junos OS 24.2 | 24.2R2-S5.5 or later |
| Junos OS 24.4 | 24.4R2-S5 or later |
| Junos OS 25.2 | 25.2R2-S2 or later |
| Junos OS 25.4 | 25.4R1-S3 or later |
| Junos OS 26.2 | 26.2R1-S2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
The Unified Threat Management daemon in Junos OS on SRX Series firewalls is vulnerable to XML injection. An unauthenticated attacker can exploit this flaw by controlling a configured custom URL-feed server to send a malicious response. This allows the attacker to commit arbitrary device configuration with root privileges over the network without requiring user interaction.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via a malicious response from a configured custom URL-feed server.
Am I affected?
[ security utm custom-objects url-feed url ]
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.