High priorityDisclosed

Advisory · CVE-2026-102062

Format string flaw in SRX ipfd lets a feed server run code as root

A use of externally-controlled format string vulnerability in the ipfd daemon of Junos OS on SRX Series lets an unauthenticated network attacker execute code with root privileges via a compromised or impersonated configured HTTPS feed server. Juniper rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-102062
CWE-134
Action timing
Immediate
ELI5

Explain it like I’m five

Feed content is supposed to be data; here it can pose as a format string and steer the daemon's own code, as root.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Feed server answers

    A compromised or impersonated HTTPS feed server responds to the SRX.

  2. 02Format string reaches ipfd

    Feed content is used as a format string by the daemon.

  3. 03Root code execution

    The format string flaw executes code with root privileges.

What happened

Juniper disclosed CVE-2026-102062 in its October 2026 security release: a format string vulnerability (CWE-134) in ipfd on SRX Series. An unauthenticated attacker who compromises or impersonates a configured HTTPS feed server can execute code with root privileges.

Juniper’s JSA112186 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for ipfd crashes and feed server changes or content anomalies preceding SRX instability.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

This is the second ipfd feed flaw in this release, next to CVE-2026-101997. Treat every feed endpoint as production infrastructure.