Junos OS on SRX: XML injection in utmd lets a malicious URL-feed server commit device configuration as root

CVSS 9.2CVE-2026-102037Firmware, BMC & network fabriccurated

Impact

The Unified Threat Management daemon parses responses from a configured custom URL-feed server without neutralising XML, so a malicious response can commit arbitrary device configuration with root privileges. This is not a crash - it is an attacker writing the firewall's own config, which means security policies, NAT rules, management access and administrative accounts can all be rewritten from a feed response. On a fleet perimeter device the operator-visible effect is a firewall that quietly stops enforcing what the running config appears to say, and a change that survives until someone compares the committed config against an authoritative baseline.

Who can reach it

Network, unauthenticated, with attack requirements present: the attacker needs to control or impersonate the custom UTM URL-feed server the device is configured to fetch from. Only SRX devices configured with a custom URL feed are exposed.

What to do

Upgrade Junos OS per Juniper advisory JSA112186; fixed releases are not in the NVD record. Until patched, removing the custom URL-feed configuration eliminates the input path, and any device that was configured with one should have its committed configuration diffed against a known-good baseline, since this flaw results in unauthorised config commits. The upgrade requires a chassis reboot - HA failover or a maintenance window.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102037 https://supportportal.juniper.net/JSA112186

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.