#NØØT_Security_Alerts 🚨 #ALERT — JUNIPER EX/SRX/QFX: ROGUE DHCP SERVER CAN TRIGGER UNAUTHENTICATED ROOT-LEVEL COMMAND EXECUTION October 14, 2026 DISCLOSED BY: Juniper Networks SIRT PRODUCT: Junos OS / Junos OS Evolved PLATFORMS: EX Series, SRX Series, QFX Series CVE: CVE-2026-102059 SEVERITY: HIGH — CVSS 3.1: 8.8 / CVSS 4.0: 8.7 WEAKNESS: CWE-78 — OS Command Injection AFFECTED VERSIONS: Vulnerable Junos OS and Junos OS Evolved releases preceding the October 14 branch-specific fixes. Junos OS fixes include: 23.2R2-S7.7 / 23.4R2-S8.13 / 24.2R2-S5.5 / 24.4R2-S5 / 25.2R2-S2 / 25.4R1-S3 / 26.2R1-S2. Junos OS Evolved has separate fixed builds, including affected X-series release trains. IMPACT: Improper command sanitization in the phone-home daemon (phcd) allows an adjacent unauthenticated attacker to execute arbitrary operating-system commands with root privileges. EXPOSURE: The attack requires a rogue DHCP server capable of supplying malicious information to a vulnerable device. The documented attack vector is ADJACENT NETWORK. Internet reachability alone does not establish exploitability. EXPLOITATION STATUS: VENDOR-CONFIRMED ROOT-LEVEL COMMAND EXECUTION VULNERABILITY. Juniper reports no known malicious exploitation. No independently confirmed public working exploit established. Forensic triage: Review DHCP server authorization and network-adjacency controls. Investigate unexpected DHCP responses, suspicious phone-home activity, unauthorized configuration changes and anomalous privileged processes. No verified attacker-specific IOCs published. URGENT ACTION: Install the appropriate vendor-fixed Junos OS or Junos OS Evolved release. Identify unauthorized DHCP servers and restrict untrusted DHCP traffic. Validate network provisioning controls. Network restrictions reduce exposure but are NOT vendor-confirmed replacements for patching. Juniper reports no known workaround. SOURCE: https://supportportal.juniper.net/JSA112187 OFFICIAL CVE: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102059.json CONFIDENCE: HIGH — Juniper-authored CVE record confirms command injection, root-level impact, affected platforms and remediation. ACTIVE EXPLOITATION: NOT VERIFIED. #CyberSecurity #ThreatIntel #Juniper #Junos #RCE #NetworkSecurity