Juniper Junos OS SRX: SQL injection in ipfd leads to remote code execution
Summary
An SQL injection flaw in the ipfd daemon of Junos OS on Juniper SRX Series devices allows an unauthenticated network-based attacker to execute code with root privileges. The attack goes through a configured Security Intelligence feed connection. According to the CNA record, the risk applies when Security Intelligence is used without tls-profile authentication. Juniper SIRT is not aware of any malicious exploitation.
Affected
- Junos OS 0 to before 23.2R2-S7.7
- Junos OS 23.4 to before 23.4R2-S8.13
- Junos OS 24.2 to before 24.2R2-S5.5
- Junos OS 24.4 to before 24.4R2-S5
- Junos OS 25.2 to before 25.2R2-S2
- Junos OS 25.4 to before 25.4R1-S3
- Junos OS 26.2 to before 26.2R1-S2
- Default configuration: not affected. Security Intelligence feed configuration required.
Fixed in
- Junos OS 23.2R2-S7.7
- Junos OS 23.4R2-S8.13
- Junos OS 24.2R2-S5.5
- Junos OS 24.4R2-S5
- Junos OS 25.2R2-S2
- Junos OS 25.4R1-S3 and 25.4R2
- Junos OS 26.2R1-S2 and 26.2R2
- Junos OS 26.4R1 and all subsequent releases
- For 23.2, 23.4 and 24.2, specific respins were issued; previously published builds were rebuilt. Verify the exact build per device.
Workaround
- Configure tls-profile authentication for Security Intelligence: services security-intelligence authentication tls-profile
- Verify the exact workaround wording and its effect in Juniper advisory JSA112186 before relying on it.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Check whether Security Intelligence feeds are configured on your SRX devices (show configuration services security-intelligence).
- Upgrade affected devices to a fixed release from JSA112186 as soon as possible.
- If patching is not possible immediately, enable tls-profile authentication for Security Intelligence.
- Restrict who can reach or impersonate the feed server and keep management access off untrusted networks.
- Monitor devices for unusual activity and assess companion ipfd flaw CVE-2026-102062 together with this one.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112186 supportportal.juniper.net
- CVE record JSON (CVE Program) raw.githubusercontent.com
- OpenCVE entry CVE-2026-101997 app.opencve.io
- CIRCL via Vulners CVE-2026-101997 vulners.com
- Strix CVE-2026-101997 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:32.
Original description (NVD)
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ipfd of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a configured Security Intelligence feed connection.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.