Why CVE-2026-102037 Scores 9.2 in CVSS v4.0 and 8.1 in v3.1

Two score systems, one vulnerability, a gap of 1.1. The difference is instructive because it shows where the two frameworks put the cost of an attack precondition.

The record

NVD lists CVE-2026-102037 with two sets of metrics, both attributed to sirt@juniper.net. The v4.0 assessment is 9.2 CRITICAL with the vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L. The v3.1 assessment is 8.1 HIGH with CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness is CWE-91, XML injection, in the Unified Threat Management daemon (utmd) of Junos OS on SRX Series devices. A malicious response from a configured custom URL-feed server lets an unauthenticated attacker commit configuration as root.

Where the two frameworks diverge

Both agree on network attack vector, no privileges required, no user interaction, and high impact to confidentiality, integrity and availability of the vulnerable system. The disagreement sits in one place: how to model the fact that a feed must be configured.

CVSS v3.1 encodes it as AC:H, high attack complexity, on the theory that the attacker must prepare conditions to succeed. CVSS v4.0 removes complexity from that role and introduces AT:P, attack requirements present, keeping AC:L.

That reclassification is why the numbers differ. In v3.1, the precondition drags the score into the high band. In v4.0, the precondition is recorded separately, so the base severity reflects the consequence rather than the setup cost.

Which number should drive the ticket

Use the v4.0 score for prioritisation if your programme has adopted v4.0, because it separates consequence from precondition and lets you apply your own judgement about how common the precondition is in your estate. Use v3.1 if your tooling has not migrated.

Either way, read the vector rather than the number. The vector tells a defender that the outcome is high integrity impact on the device itself, with limited scope change to other components. That is consistent with a configuration commit that alters the box rather than directly executing code elsewhere.

The affected builds behind the score

Fixed versions published with the October 2026 patchday are 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2 for the matching branches. Full-string comparison is required because the fix lives in the maintenance suffix.

Exposure context

No ZoomEye assets are indexed for the CVE identifier. Product queries describe the installed base at 1,500 for product="Junos" and 1,977 for os="Junos", which is a measure of internet-visible systems rather than vulnerable ones.

The takeaway for scoring debates

A 9.2 and an 8.1 describe the same defect with different accounting for the same constraint. Teams that argue about which is correct often have not read the vector. The vector is where the actionable information lives, and both vectors say the same thing: if the precondition holds, the outcome is severe.