---
id: CVE-2026-102059
title: "An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on\_EX Series, SRX Series, and QFX Series allows…"
summary: "An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on\_EX Series, SRX Series, and QFX Series allows…"
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T17:18:01.253'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102059'
references:
  - url: 'https://supportportal.juniper.net/JSA112187'
    label: sirt@juniper.net
tags:
  - nvd
ingestedAt: '2026-10-14T17:44:53.661Z'
---

## Overview

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary commands with root privileges via a rogue DHCP server.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.