External risk intelligence

Juniper SRX SQL Injection Allows Root Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-101997

The vulnerability affects a network-facing daemon in a core networking device (Juniper SRX). While it requires a configured Security Intelligence feed, these features are common in gateway and edge security appliances, placing the management or processing interface in a position where it is frequently reachable by network-based actors.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in Juniper Networks Junos OS affects SRX Series devices, specifically impacting the Security Intelligence feed connection. It allows an attacker to potentially execute code with root privileges, which is a critical concern for network security infrastructure. The main leadership concern is to confirm if this technology is in use and to what extent it may be exposed.

A security flaw allows unauthorized code execution.
Affects core network security devices.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker on the network can exploit this by sending specially crafted input to a configured Security Intelligence feed connection on Juniper Networks Junos OS on SRX Series devices, potentially leading to code execution with root privileges.

Attack requires a configured feed connection.
Vulnerable component is the Security Intelligence feed.
Risk is root code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Juniper Networks Junos OS on SRX Series could allow an unauthenticated attacker to execute commands with root privileges when a Security Intelligence feed is configured. This may impact the integrity and availability of the affected device.

System access and code execution at risk.
Exposure via configured Security Intelligence feed.
Could lead to system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The critical SQL injection vulnerability in Juniper Junos OS on SRX Series devices requires immediate attention from infrastructure and security teams. The first step is to identify all SRX devices with configured Security Intelligence feeds, assess their network exposure, and determine if they are business-critical. This will help in prioritizing remediation efforts and engaging the relevant system owners to plan for mitigation.

Infrastructure and security teams own this.
Verify SRX devices with configured feeds.
Plan vendor engagement and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Junos OS on SRX Series devices?

Junos OS is the operating system powering Juniper Networks' SRX Series, which are high-performance security gateways and firewalls. These devices sit at the edge of networks to manage traffic and provide security services. The 'ipfd' daemon within this software handles various networking functions, including the Security Intelligence feature used to ingest threat feeds that help the device filter malicious traffic.

How does SQL injection work in CVE-2026-101997?

This vulnerability, classified as CWE-89, occurs when software improperly handles special characters in data. In this case, an attacker sends malicious input to the Security Intelligence feed connection. Because the system fails to neutralize this input properly before processing it as a command, the attacker can manipulate the underlying database queries to execute arbitrary code with root-level privileges.

Do I need a Security Intelligence feed for this to be a risk?

Yes. This vulnerability is specific to the handling of Security Intelligence feed connections. If your SRX device does not have this specific feature configured or active, the vulnerable code path in the ipfd daemon is not engaged by this attack vector. Devices without an active feed configuration are not susceptible to this specific trigger.

Is my device at risk if it faces the internet?

Halo Surface Signal indicates that because this vulnerability impacts a network-facing daemon in a core security appliance, it is highly relevant for devices exposed to the internet. Since these appliances often manage or process external traffic, network-based actors can potentially reach the affected interface, making internet-facing SRX devices a primary concern for potential exploitation.

What should I do first to address CVE-2026-101997?

Begin by auditing your infrastructure to identify every SRX device running Junos OS. Once you have a list, verify which specific units have a Security Intelligence feed currently enabled. Prioritize these active devices for remediation by coordinating with your security teams to confirm business-critical systems and prepare for the necessary software updates or vendor-provided mitigations.

References

supportportal.juniper.net/JSA112186

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.