CVE-2026-102059
Last modified
CVE-2026-102059 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary commands with root privileges via a rogue DHCP server.. EPSS estimates a 3.89% chance of exploitation in the next 30 days.
Description
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary commands with root privileges via a rogue DHCP server.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Juniper Networks | Junos OS | < 23.2R2-S7.7; >= 23.4, < 23.4R2-S8.13; >= 24.2, < 24.2R2-S5.5; >= 24.4, < 24.4R2-S5; >= 25.2, < 25.2R2-S2; >= 25.4, < 25.4R1-S3; >= 26.2, < 26.2R1-S2 |
| Juniper Networks | Junos OS Evolved | < 23.2R2-S7.7-EVO; >= 23.4, < 23.4R2-S8.11-EVO; >= 24.2, < 24.2R2-S5.6-EVO; >= 24.4, < 24.4R2-S5-EVO; >= 25.2, < 25.2R2-S2-EVO; >= 25.4, < 25.4R1-S3-EVO; >= 26.2, < 26.2R1-S2-EVO; 23.4X100; >= 25.2X100, < 25.2X100-D35-EVO; >= 25.4X300, < 25.4X300-D40-EVO |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-102059?
How severe is CVE-2026-102059?
How do I fix CVE-2026-102059?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-102053An Improper Release of Memory Before Removing Last Reference…5.3
- CVE-2026-102054An Improper Handling of Length Parameter Inconsistency vulne…4.3
- CVE-2026-102055A Stack-based Buffer Overflow vulnerability in the cfmd proc…8.8
- CVE-2026-102056An Out-of-bounds Read vulnerability in the cfmd process of J…7.1
- CVE-2026-102057A Stack-based Buffer Overflow vulnerability in the jdhcpd pr…7.5
- CVE-2026-102058A Reachable Assertion vulnerability in the bfdd daemon of Ju…6.5
- CVE-2026-10206A vulnerability was detected in D-Link DI-8400 up to 16.07.2…8.8
- CVE-2026-102060A NULL Pointer Dereference vulnerability in the rpd process …6.5
- CVE-2026-102061A Stack-based Buffer Overflow vulnerability in the phone-hom…8.8
- CVE-2026-102062An Use of Externally-Controlled Format String vulnerability …8.1
- CVE-2026-102063A Reachable Assertion vulnerability in the routing protocol …6.5
- CVE-2026-102064A Reachable Assertion vulnerability in the routing protocol …7.5
Are you affected by CVE-2026-102059?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST