CVE-2026-102037

critical · 9.2

An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via a malicious response from a configured custom URL-feed server.

9.2

CVSS

0.5%

EPSS (exploit prob.)

41st

EPSS percentile

2026-10-14

Published

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X

Weaknesses

CWE-91

References

https://supportportal.juniper.net/JSA112186

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-102037