Junos OS (SRX firewalls)
CVE-2026-102059: EX Series, SRX Series, QFX Series: A rogue DHCP server causes root-level command execution when the phone-home client processes specific information
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary commands with root privileges via a rogue DHCP server.
Published Juniper Networks advisory JSA112187
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (EX Series, SRX Series, QFX Series) 0 | 23.2R2-S7.7 or later |
| Junos OS (EX Series, SRX Series, QFX Series) 23.4 | 23.4R2-S8.13 or later |
| Junos OS (EX Series, SRX Series, QFX Series) 24.2 | 24.2R2-S5.5 or later |
| Junos OS (EX Series, SRX Series, QFX Series) 24.4 | 24.4R2-S5 or later |
| Junos OS (EX Series, SRX Series, QFX Series) 25.2 | 25.2R2-S2 or later |
| Junos OS (EX Series, SRX Series, QFX Series) 25.4 | 25.4R1-S3 or later |
| Junos OS (EX Series, SRX Series, QFX Series) 26.2 | 26.2R1-S2 or later |
| Junos OS Evolved (SRX Series, QFX Series) 0 | 23.2R2-S7.7-EVO or later |
| Junos OS Evolved (SRX Series, QFX Series) 23.4 | 23.4R2-S8.11-EVO or later |
| Junos OS Evolved (SRX Series, QFX Series) 24.2 | 24.2R2-S5.6-EVO or later |
| Junos OS Evolved (SRX Series, QFX Series) 24.4 | 24.4R2-S5-EVO or later |
| Junos OS Evolved (SRX Series, QFX Series) 25.2 | 25.2R2-S2-EVO or later |
| Junos OS Evolved (SRX Series, QFX Series) 25.4 | 25.4R1-S3-EVO or later |
| Junos OS Evolved (SRX Series, QFX Series) 26.2 | 26.2R1-S2-EVO or later |
| Junos OS Evolved (SRX Series, QFX Series) 23.4X100 | See the advisory |
| Junos OS Evolved (SRX Series, QFX Series) 25.2X100 | 25.2X100-D35-EVO or later |
| Junos OS Evolved (SRX Series, QFX Series) 25.4X300 | 25.4X300-D40-EVO or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
The phone-home daemon in Junos OS fails to properly sanitize input, allowing an OS command injection vulnerability. An unauthenticated attacker on an adjacent network can exploit this flaw by deploying a rogue DHCP server to execute arbitrary commands with root privileges. This attack requires no user interaction or prior login to the device.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary commands with root privileges via a rogue DHCP server.
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.