Junos OS CVE-2026-101997

Exploitation REQUIRES that the SRX device be configured with a Security Intelligence (SecIntel) feed connection - the vulnerable ipfd process must be actively handling such a feed; devices without a configured SecIntel feed are not exposed. The CVSS 4.0 AT:P (Attack Requirements Present) metric confirms a non-trivial precondition beyond mere network reachability: the attacker must be positioned to influence or supply data over that feed connection. The flaw is unauthenticated (PR:N) and needs no user interaction (UI:N), but the non-default feed configuration and the need to control the feed channel are the primary limiting factors for defenders assessing realistic exposure. Affects SRX Series running Junos OS.

This is a genuine high-priority vulnerability by vendor-assigned severity: CVSS 4.0 base score of 9.2 (Critical) with AV:N, AC:L, PR:N, UI:N and full High impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H), describing unauthenticated network-based code execution as root - the most severe outcome possible on a security appliance. The single strongest mitigating signal in the vector is AT:P (Attack Requirements: Present), meaning exploitation depends on specific conditions outside the attacker's direct control - here, that the SRX device is actually configured with a Security Intelligence feed connection and that the attacker can influence that feed channel. This materially narrows the exploitable population versus a blanket 'default-config, remote, unauthenticated' flaw. Critically, several real-world-risk signals are MISSING from the input and must NOT be assumed: there is no EPSS score, no CISA KEV listing, and no POC/exploit-code indicator provided, so at time of analysis there is no public exploit identified and no evidence of active exploitation. The verdict: treat as a real priority for any organization running SRX Series with SecIntel feeds configured (SQLi-to-root on a perimeter security device is a worst-case technical impact), but the AT:P condition and absence of exploitation evidence mean it is not yet demonstrably mass-exploitable - distinguish configured-and-exposed devices from the broader SRX fleet when prioritizing.

An SRX Series firewall is configured to pull a Security Intelligence (SecIntel) feed; the ipfd process fails to neutralize special elements in data received over that feed connection, allowing SQL injection. A network-positioned attacker who can influence or respond to the configured feed connection delivers a crafted response that injects SQL and escalates to arbitrary code execution as root on the device. No public exploit code was identified in the provided data, and the AT:P requirement means the attacker must reach/control the feed channel rather than simply hitting an open port.