High priorityDisclosed

Advisory · CVE-2026-102059

Command injection in Junos phone-home daemon lets a rogue DHCP server run commands as root

An OS command injection vulnerability in the phone-home daemon (phcd) of Junos OS and Junos OS Evolved on EX, SRX, and QFX Series lets an adjacent unauthenticated attacker execute arbitrary commands with root privileges via a rogue DHCP server. Juniper rates it CVSS 3.1 8.8.

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-102059
CWE-78
Action timing
Immediate
ELI5

Explain it like I’m five

During zero-touch setup the device phones home for instructions; a rogue DHCP answer can slip shell commands into that conversation.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Device starts phone-home

    A device in provisioning reaches out through the phone-home process.

  2. 02Rogue DHCP answers

    An adjacent attacker's DHCP server supplies values that phcd treats as command input.

  3. 03Commands run as root

    The injected commands execute with root privileges.

What happened

Juniper disclosed CVE-2026-102059 in its October 2026 security release: an OS command injection vulnerability (CWE-78) in the phone-home daemon (phcd) on EX, SRX, and QFX Series. An adjacent unauthenticated attacker running a rogue DHCP server can get arbitrary commands executed with root privileges.

Juniper’s JSA112187 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for unexpected commands or configuration on newly provisioned devices and rogue DHCP servers on provisioning segments.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Provisioning networks are soft targets by design. Patch, and isolate zero-touch segments until devices are fully enrolled.