CVE-2026-102062: Junos OS: SRX Series: An compromised HTTPS feed server can cause remote code execution when Security Intelligence is used
An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a compromised or impersonated configured HTTPS feed server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Junos OS SRX Seriesto a version that resolves this vulnerability.Fixed in 23.2R2-S7.7 - Upgrade
Upgrade
Juniper Junos OS SRX Seriesto a version that resolves this vulnerability.Fixed in 23.4R2-S8.13 - Upgrade
Upgrade
Juniper Junos OS SRX Seriesto a version that resolves this vulnerability.Fixed in 24.2R2-S5.5 - Upgrade
Upgrade
Juniper Junos OS SRX Seriesto a version that resolves this vulnerability.Fixed in 24.4R2-S5 - Upgrade
Upgrade
Juniper Junos OS SRX Seriesto a version that resolves this vulnerability.Fixed in 25.2R2-S2 - Upgrade
Upgrade
Juniper Junos OS SRX Seriesto a version that resolves this vulnerability.Fixed in 25.4R1-S3 - Upgrade
Upgrade
Juniper Junos OS SRX Seriesto a version that resolves this vulnerability.Fixed in 25.4R2 - Upgrade
Upgrade
Juniper Junos OS SRX Seriesto a version that resolves this vulnerability.Fixed in 26.2R1-S2 - Upgrade
Upgrade
Juniper Junos OS SRX Seriesto a version that resolves this vulnerability.Fixed in 26.2R2 - Upgrade
Upgrade
Juniper Junos OS SRX Seriesto a version that resolves this vulnerability.Fixed in 26.4R1
Event History
Frequently Asked Questions
What must an attacker control to exploit this issue?
The attacker must compromise or impersonate an HTTPS feed server that is configured for Security Intelligence. Exploitation is network-based and does not require authentication to the affected SRX device.
What level of access could successful exploitation provide?
Successful exploitation can allow remote code execution with root privileges on the affected SRX device.
Are SRX devices affected simply by being reachable over the network?
The described attack path requires use of Security Intelligence and a configured HTTPS feed server that can be compromised or impersonated. The provided information does not establish that SRX devices without this configuration are affected.