{"id":"CVE-2026-102037","title":"An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via…","summary":"An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-91"],"published":"2026-10-14","updated":"2026-10-14","sourceUpdated":"2026-10-14T17:17:57.867","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102037","references":[{"url":"https://supportportal.juniper.net/JSA112186","label":"sirt@juniper.net"}],"tags":["nvd"],"ingestedAt":"2026-10-14T17:44:53.654Z","slug":"CVE-2026-102037","body":"## Overview\n\nAn XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via a malicious response from a configured custom URL-feed server.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}