CVE-2026-102059

Name of the Vulnerable Software and Affected Versions Junos OS versions prior to 23.2R2-S7.7 Junos OS versions prior to 23.4R2-S8.13 Junos OS versions prior to 24.2R2-S5.5 Junos OS versions prior to 24.4R2-S5 Junos OS versions prior to 25.2R2-S2 Junos OS versions prior to 25.4R1-S3 Junos OS versions prior to 26.2R1-S2 Junos OS Evolved (affected versions not specified)

Description An OS Command Injection issue exists in the phone-home daemon (phcd) of Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series. This occurs due to improper neutralization of special elements used in an OS command. An adjacent unauthenticated attacker can exploit this by using a rogue DHCP server to supply malicious information, allowing the execution of arbitrary operating-system commands with root privileges.

Recommendations Update Junos OS to version 23.2R2-S7.7 or later. Update Junos OS to version 23.4R2-S8.13 or later. Update Junos OS to version 24.2R2-S5.5 or later. Update Junos OS to version 24.4R2-S5 or later. Update Junos OS to version 25.2R2-S2 or later. Update Junos OS to version 25.4R1-S3 or later. Update Junos OS to version 26.2R1-S2 or later. Install the appropriate vendor-fixed Junos OS Evolved release. Identify unauthorized DHCP servers and restrict untrusted DHCP traffic. Validate network provisioning controls.