Junos OS CVE-2026-102037

Exploitation requires the SRX device to be running UTM with a custom URL-category feed (custom URL-feed) pointing at a configured custom URL-feed server - a non-default feature that must be explicitly enabled. The attacker must additionally control that feed server or be positioned to intercept and alter its response (MITM) so utmd receives malicious XML. Devices without a configured custom URL-feed are not exposed via this path. While no credentials are needed (PR:N), these configuration and positioning prerequisites (reflected as AT:P) are the primary limiting factors; the exploit is network-reachable with low complexity only once they hold.

This is a genuine high-priority issue, not an inflated high-CVSS artifact. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) with VC:H/VI:H/VA:H yields 9.2 (Critical), and the outcome - an unauthenticated attacker committing arbitrary device configuration with root privileges - represents total compromise of a security appliance. The key tempering signal is AT:P (Attack Requirements: Present): exploitation is not a simple remote-unauth hit against a default box. It requires the SRX to have a UTM custom URL-feed server configured AND the attacker to control or intercept that server's response, so this is conditional rather than universally reachable. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk is driven by severity and ease-of-use once the precondition is met, not by observed in-the-wild activity. Supplemental metrics reinforce priority (AU:Y automatable, V:C concentrated value), meaning that where the precondition holds, exploitation could be scripted. Note a minor inconsistency: the vector marks subsequent-system availability SA:L while SC:N/SI:N, and the 'root configuration commit' outcome arguably implies broader device/scope impact than the subsequent-system metrics capture - verify blast radius against the Juniper advisory.

An SRX Series firewall is configured to pull a UTM custom URL-category feed from an external URL-feed server. An attacker who controls that feed server (or who can machine-in-the-middle the unauthenticated/unvalidated connection to it) returns a crafted response containing injected XML, which utmd parses and uses to commit attacker-chosen configuration on the device as root. No public exploit code was provided in the intelligence, so this reflects the CVSS network vector (AV:N) and low attack complexity (AC:L) rather than an observed POC.