---
id: CVE-2026-102037
title: >-
  An XML Injection vulnerability in the Unified Threat Management daemon (utmd)
  of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated
  network attacker to commit arbitrary device configuration with root privileges
  via…
summary: >-
  An XML Injection vulnerability in the Unified Threat Management daemon (utmd)
  of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated
  network attacker to commit arbitrary device configuration with root privileges
  via…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-91
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T17:17:57.867'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102037'
references:
  - url: 'https://supportportal.juniper.net/JSA112186'
    label: sirt@juniper.net
tags:
  - nvd
ingestedAt: '2026-10-14T17:44:53.654Z'
---

## Overview

An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via a malicious response from a configured custom URL-feed server.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.