High priorityDisclosed

Advisory · CVE-2026-101997

SQL injection in SRX ipfd via security intelligence feeds can run code as root

An SQL injection vulnerability in ipfd on Junos OS SRX Series lets an unauthenticated network attacker execute code with root privileges through a configured Security Intelligence feed connection. Juniper rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-101997
CWE-89
Action timing
Immediate
ELI5

Explain it like I’m five

The firewall pulls threat feeds to stay safe, and the feed connection itself becomes the injection point, as root.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Feed connection abused

    The attacker influences a configured Security Intelligence feed connection to an SRX.

  2. 02SQL injected

    Feed data reaches ipfd's database handling without proper neutralization.

  3. 03Root code execution

    The injection executes code with root privileges on the firewall.

What happened

Juniper disclosed CVE-2026-101997 in its October 2026 security release: an SQL injection vulnerability (CWE-89) in the ipfd daemon on SRX Series. An unauthenticated network attacker who can influence a configured Security Intelligence feed connection can inject SQL that leads to code execution with root privileges.

Juniper’s JSA112186 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for ipfd crashes, unexpected feed content, and configuration or process changes following feed updates.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Threat feeds are inbound trust. Verify feed endpoints, patch SRX devices using Security Intelligence, and review feed configuration.