The vulnerability is an XML Injection flaw in the Unified Threat Management daemon of Junos OS on SRX Series devices, enabling an unauthenticated network attacker to commit arbitrary configuration changes with root privileges via a malicious response from a configured custom URL‑feed server. This allows the attacker to alter firewall rules, routing policies, or other critical settings, effectively taking full control over the device’s configuration and potentially compromising network security.

Juniper Networks Junos OS SRX Series devices are affected. The issue appears in releases 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all subsequent releases. For 23.4 and 24.2, specific respins have been provided to resolve the vulnerability.

This flaw carries a CVSS score of 9.2, indicating critical severity. The EPSS score is not reported and the vulnerability is not listed in the CISA KEV catalog, but the lack of authentication and network‑based nature of the attack vector suggest that remote attackers could exploit it from any reachable network segment. Because the flaw is an XML Injection, a malicious custom URL‑feed response can be delivered by any server the device contacts, making exploitation straightforward for attackers who control or can spoof that feed source.