High priorityDisclosed

Advisory · CVE-2026-102037

XML injection in SRX UTM daemon lets a rogue URL feed commit configuration as root

An XML injection vulnerability in the Unified Threat Management daemon (utmd) of Junos OS on SRX Series lets an unauthenticated network attacker commit arbitrary device configuration with root privileges through a malicious response from a configured custom URL-feed server. Juniper rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-102037
CWE-91
Action timing
Immediate
ELI5

Explain it like I’m five

A feed server the firewall trusts for URL lists can answer with XML that rewrites the firewall's own configuration, as root.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01URL feed requested

    The SRX asks its configured custom URL-feed server for updated lists.

  2. 02Malicious XML returned

    The server answers with XML crafted to inject configuration elements.

  3. 03Configuration committed as root

    utmd commits the injected configuration with root privileges.

What happened

Juniper disclosed CVE-2026-102037 in its October 2026 security release: an XML injection vulnerability (CWE-91) in utmd on SRX Series. A malicious response from a configured custom URL-feed server can inject XML that commits arbitrary device configuration with root privileges. The vendor record lists affected releases starting with the 23.4 line.

Juniper’s JSA112186 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for configuration commits on SRX devices that no administrator made, following URL-feed updates.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Custom feeds are code-adjacent input. Patch, pin down feed servers, and audit SRX configuration history after feed changes.