Security2 hOctober 21, 2026, 23:41

Segmentation proposed as mitigation for CVE-2026-102037 in Junos OS

CVE-2026-102037 in the utmd daemon of Junos OS on SRX devices lets an unauthenticated attacker gain root via XML injection in a custom URL-feed response. CVSS v4.0 scores 9.2. Fixes shipped in the October 2026 patchday across six branches, including 23.4R2-S8.13 and 26.2R1-S2.

DEV Community

Open source

Segmentation proposed as mitigation for CVE-2026-102037 in Junos OS

XML injection in utmd allows arbitrary configuration with root privileges
CVSS v4.0 is 9.2, v3.1 is 8.1, weakness is CWE-91
Fixed builds: 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2
A dedicated feed zone narrows the set of potential attackers

#Juniper#Junos#SRX

Junos OS SRX XML injection flaw rated CVSS 9.2

Security

Pre-auth RCE in Junos srxpfe on SRX exposed via GRE tunnels

Security

Compensating Controls Offered for Critical Junos SRX GRE Flaw

Security

Segmentation proposed as mitigation for CVE-2026-102037 in Junos OS

Junos OS SRX XML injection flaw rated CVSS 9.2

Pre-auth RCE in Junos srxpfe on SRX exposed via GRE tunnels

Compensating Controls Offered for Critical Junos SRX GRE Flaw

F5 and Juniper Patch Critical RCE Vulnerabilities