External risk intelligence

Juniper Junos OS SRX XML Injection Allows Root Configuration Commit

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-102037

The vulnerability exists in the Unified Threat Management daemon of SRX Series firewalls, which are network security appliances commonly deployed at the edge of networks to filter traffic. The attack relies on a custom URL-feed server connection, a common configuration for security gateways, making the attack surface frequently exposed or reachable in environments utilizing these external feed features.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical XML Injection vulnerability in Juniper Networks' Junos OS on SRX Series devices. An attacker could exploit this flaw by sending a malicious response from a configured custom URL-feed server, potentially leading to unauthorized root-level configuration changes on the device. This could impact the security posture and operational integrity of network edge security appliances.

Unauthenticated attackers can change device configurations.
Devices on network edges are commonly used for threat management.
Confirm relevance and exposure for network edge security.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted malicious response from a configured custom URL-feed server to the Unified Threat Management daemon. This interaction could allow an unauthenticated attacker to execute arbitrary device configurations with root privileges.

Entry Condition: Unauthenticated network access.
Trigger Point: Malicious response from a custom URL-feed server.
Resulting Risk: Arbitrary device configuration with root privileges.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could compromise the device configuration of Juniper Networks SRX Series devices by exploiting an XML Injection vulnerability. This could occur when the device is configured to fetch custom URL feeds from a malicious server, allowing the attacker to inject commands that result in arbitrary configuration changes with root privileges.

Device configuration and root access.
Malicious URL-feed server response.
Complete device compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Unified Threat Management daemon on Juniper SRX Series devices is susceptible to XML Injection, allowing unauthenticated attackers to gain root privileges by exploiting malicious responses from configured custom URL-feed servers. Infrastructure or network security teams responsible for managing these SRX firewalls should first confirm the presence and reachability of the affected daemon and its custom URL-feed configurations. Subsequently, a risk-based remediation plan should be developed, potentially involving vendor coordination or temporary mitigation if immediate patching is not feasible.

Network and Security Teams own this issue.
Verify custom URL-feed server reachability.
Plan remediation based on business criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Juniper Junos OS on SRX Series devices?

These are network security appliances that function as high-performance firewalls. They use a Unified Threat Management (UTM) daemon to inspect traffic, filter content, and manage security policies at the network edge, helping organizations protect their internal environments from external threats.

What is the XML Injection vulnerability in CVE-2026-102037?

This is a CWE-91 weakness where an application incorrectly interprets user-provided XML data. In this specific CVE, the system fails to properly sanitize input received from a URL-feed server. An attacker can manipulate this data to inject unauthorized commands, granting them root-level control over the device's configuration.

How can an attacker trigger this vulnerability?

An attacker triggers this by providing a malicious response from a custom URL-feed server that the device is configured to reach. Merely having the device on the network is insufficient; the attack specifically requires the device to be actively configured to fetch data from an untrusted or compromised external URL-feed source.

Is my network at risk from this CVE?

According to Halo Surface Signal, this vulnerability is most relevant if your SRX firewalls use custom URL-feed features. Because these devices often sit at the network edge to filter traffic, any instance configured to pull external feeds is potentially reachable by an attacker, making this a critical concern for those specific deployments.

What steps should I take if I use SRX devices?

First, identify if your infrastructure utilizes the custom URL-feed functionality within the Unified Threat Management daemon. Review your current device configurations to determine if these feeds are active. Once you understand your setup, prioritize verifying the security of any external feed sources and coordinate with your team to plan for vendor-provided updates.

References

supportportal.juniper.net/JSA112186

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.