{"meta":{"title":"KEV entries: Juniper","description":"All KEV entries for vendor Juniper.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":8,"vendor":"Juniper","entries":8,"shareOfCatalogPercent":0.5,"ransomwareKnown":0,"firstDateAdded":"2022-03-25","latestDateAdded":"2025-10-02","rank":34},"data":[{"cveID":"CVE-2015-7755","vendorProject":"Juniper","product":"ScreenOS","vulnerabilityName":"Juniper ScreenOS Improper Authentication Vulnerability","dateAdded":"2025-10-02","dueDate":"2025-10-23","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-287"],"shortDescription":"Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://supportportal.juniper.net/s/article/2015-12-Out-of-Cycle-Security-Bulletin-ScreenOS-Multiple-Security-issues-with-ScreenOS-CVE-2015-7755-CVE-2015-7756 ; https://nvd.nist.gov/vuln/detail/CVE-2015-7755","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2015-7755"},{"cveID":"CVE-2025-21590","vendorProject":"Juniper","product":"Junos OS","vulnerabilityName":"Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability","dateAdded":"2025-03-13","dueDate":"2025-04-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-653"],"shortDescription":"Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://supportportal.juniper.net/s/article/2025-03-Out-of-Cycle-Security-Bulletin-Junos-OS-A-local-attacker-with-shell-access-can-execute-arbitrary-code-CVE-2025-21590?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2025-21590","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-21590"},{"cveID":"CVE-2023-36851","vendorProject":"Juniper","product":"Junos OS","vulnerabilityName":"Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability","dateAdded":"2023-11-13","dueDate":"2023-11-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-306"],"shortDescription":"Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US ;  https://nvd.nist.gov/vuln/detail/CVE-2023-36851","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-36851"},{"cveID":"CVE-2023-36847","vendorProject":"Juniper","product":"Junos OS","vulnerabilityName":"Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability","dateAdded":"2023-11-13","dueDate":"2023-11-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-306"],"shortDescription":"Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US;  https://nvd.nist.gov/vuln/detail/CVE-2023-36847","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-36847"},{"cveID":"CVE-2023-36846","vendorProject":"Juniper","product":"Junos OS","vulnerabilityName":"Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability","dateAdded":"2023-11-13","dueDate":"2023-11-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-306"],"shortDescription":"Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US ;  https://nvd.nist.gov/vuln/detail/CVE-2023-36846","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-36846"},{"cveID":"CVE-2023-36845","vendorProject":"Juniper","product":"Junos OS","vulnerabilityName":"Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability","dateAdded":"2023-11-13","dueDate":"2023-11-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-473"],"shortDescription":"Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US ;  https://nvd.nist.gov/vuln/detail/CVE-2023-36845","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-36845"},{"cveID":"CVE-2023-36844","vendorProject":"Juniper","product":"Junos OS","vulnerabilityName":"Juniper Junos OS EX Series PHP External Variable Modification Vulnerability","dateAdded":"2023-11-13","dueDate":"2023-11-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-473"],"shortDescription":"Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US ;  https://nvd.nist.gov/vuln/detail/CVE-2023-36844","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-36844"},{"cveID":"CVE-2020-1631","vendorProject":"Juniper","product":"Junos OS","vulnerabilityName":"Juniper Junos OS Path Traversal Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-22","CWE-73"],"shortDescription":"A path traversal vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-1631","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-1631"}]}