CVE-2026-102062

Name of the Vulnerable Software and Affected Versions Junos OS versions prior to 23.2R2-S7.7 Junos OS versions prior to 23.4R2-S8.13 Junos OS versions prior to 24.2R2-S5.5 Junos OS versions prior to 24.4R2-S5 Junos OS versions prior to 25.2R2-S2 Junos OS versions prior to 25.4R1-S3 Junos OS versions prior to 26.2R1-S2

Description An unauthenticated network-based attacker can execute arbitrary code with root privileges through the ipfd daemon. This issue occurs when the SRX device uses Security Intelligence with a configured HTTPS feed server that has been compromised or impersonated. The flaw is caused by the use of an externally-controlled format string, which allows the attacker to trigger remote code execution.

Recommendations Upgrade to Junos OS version 23.2R2-S7.7 or later. Upgrade to Junos OS version 23.4R2-S8.13 or later. Upgrade to Junos OS version 24.2R2-S5.5 or later. Upgrade to Junos OS version 24.4R2-S5 or later. Upgrade to Junos OS version 25.2R2-S2 or later. Upgrade to Junos OS version 25.4R1-S3 or later. Upgrade to Junos OS version 26.2R1-S2 or later. Verify the integrity and authorization of configured HTTPS feed sources. Investigate suspicious feed infrastructure.