CVE-2026-102037: CWE-91 XML Injection (aka Blind XPath Injection) in Juniper Networks Junos OS

This vulnerability (CVE-2026-102037) involves XML Injection (CWE-91) in the utmd component of Juniper Networks Junos OS on SRX Series devices. An unauthenticated attacker can leverage a malicious response from a custom URL-feed server to inject XML payloads that result in arbitrary device configuration changes with root-level privileges. The flaw affects multiple Junos OS versions across several release trains, with fixed versions starting from 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, and 26.2R1-S2 respectively. The vulnerability has a CVSS v3.1 base score of 8.1, reflecting high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated network attacker to gain root-level control over the device configuration, potentially leading to full compromise of affected Junos OS devices. This impacts confidentiality, integrity, and availability of the device and network it protects. There are no known exploits in the wild at the time of publication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The affected versions indicate that fixed releases exist starting from 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, and 26.2R1-S2. Users should upgrade to these or later versions once official patches are available. Until then, restrict access to the Unified Threat Management daemon and carefully control any configured custom URL-feed servers to mitigate risk.