Junos OS SRX XML injection flaw rated CVSS 9.2

NVD detailed CVE-2026-102037 in the utmd daemon of Junos OS on SRX devices: a malicious response from a configured custom URL-feed server lets an unauthenticated attacker commit arbitrary configuration with root privileges. CVSS v4.0 is 9.2, with fixes shipped in the October 2026 patchday builds.

• CWE-91 XML injection in Junos OS utmd on SRX, CVSS v4.0 9.2
• Exploitation comes via a malicious URL-feed server response
• Fixed builds include 23.4R2-S8.13, 24.4R2-S5 and 26.2R1-S2
• Network sensors cannot see the resulting config commit