Junos OS SRX Series: XML injection in utmd allows arbitrary configuration commit

Summary

Juniper Junos OS on SRX Series devices contains an XML injection flaw in the Unified Threat Management daemon (utmd). An unauthenticated network attacker who can supply a malicious response from a configured custom URL-feed server can make the device commit arbitrary configuration with root privileges. The flaw only applies when the custom URL feed is configured; Juniper's CNA record gives a CVSS v4.0 score of 9.2 (Critical).

Affected

• Junos OS 23.4 to before 23.4R2-S8.13
• Junos OS 24.2 to before 24.2R2-S5.5
• Junos OS 24.4 to before 24.4R2-S5
• Junos OS 25.2 to before 25.2R2-S2
• Junos OS 25.4 to before 25.4R1-S3
• Junos OS 26.2 to before 26.2R1-S2
• Default configuration: not affected. Required configuration: security utm custom-objects url-feed url
• Releases older than 23.4: Unknown.

Fixed in

• Junos OS 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
• Juniper states that releases 23.4 and 24.2 were respun and previously published builds were rebuilt. Verify the exact build in JSA112186.

Workaround

• No known workarounds according to the Juniper CNA record.
• Unofficial suggestions from secondary sources, not confirmed by Juniper: remove or disable the custom URL-feed configuration; restrict the feed to trusted, authenticated sources; fetch the feed over TLS with certificate validation; allow outbound feed traffic only to the feed server.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• Not listed in CISA KEV according to Strix. EPSS approx. 0.005.
• No public PoC or exploit found in the research; the search was not exhaustive.

Our recommendation

• Check whether any SRX device has the custom URL feed configured (security utm custom-objects url-feed).
• Upgrade affected devices to a fixed release listed in JSA112186, starting with devices that use the custom URL feed.
• Until patched, remove the custom URL feed if it is not needed, or restrict feed sources and outbound feed traffic.
• Monitor device logs for unexpected configuration commits.
• Re-check the Juniper advisory and CISA KEV for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112186 supportportal.juniper.net
• Vulners VulnRichment CVE-2026-102037 vulners.com
• OpenCVE CVE-2026-102037 app.opencve.io
• Strix CVE-2026-102037 www.strix.ai
• CVSS v4.0 vs v3.1 scoring analysis dev.to
• Patch window trade-offs for CVE-2026-102037 dev.to
• Hardening choices while CVE-2026-102037 waits for a change window dev.to

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:31.