Juniper
Vulnerability activity for Juniper: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 7
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 8
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 9
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 9.8CriticalDec 19, 2015Juniper ScreenOS Auth bypass / access controlCVE-2015-7755Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device.Added to KEV Oct 2, 2025 · 3,575 days after publicationExploited61% likelyExploit codeMetasploitDetection
- 4.4MediumMar 12, 2025Juniper Junos OSCVE-2025-21590Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.Added to KEV Mar 13, 2025 · same day as publicationExploited1.7% likely
- 5.3MediumSep 26, 2023Juniper Junos OS Auth bypass / access controlCVE-2023-36851Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.Added to KEV Nov 13, 2023 · 47 days after publicationExploited1.1% likely
- 5.3MediumAug 17, 2023Juniper Junos OS Auth bypass / access controlCVE-2023-36847Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.Added to KEV Nov 13, 2023 · 87 days after publicationExploited83% likelyDetection
- 5.3MediumAug 17, 2023Juniper Junos OS Auth bypass / access controlCVE-2023-36846Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.Added to KEV Nov 13, 2023 · 87 days after publicationExploited93% likelyDetection
- 9.8CriticalAug 17, 2023Juniper Junos OSCVE-2023-36845Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.Added to KEV Nov 13, 2023 · 87 days after publicationExploited95% likelyExploit codeMetasploit · NucleiDetection
- 5.3MediumAug 17, 2023Juniper Junos OSCVE-2023-36844Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities.Added to KEV Nov 13, 2023 · 87 days after publicationExploited90% likelyExploit codeNucleiDetection
- 8.8HighMay 4, 2020Juniper Junos OS Path traversal / file handlingCVE-2020-1631A path traversal vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform remote code execution.Added to KEV Mar 25, 2022 · 690 days after publicationExploited4.9% likely
Recent
- –UnscoredOct 28, 2026JuniperADV-juniper-6fedcc071f902026-10 On-Demand Security Bulletin: Session Smart Router and Session Smart Conductor: Multiple internally discovered vulnerabilities resolved
- –UnscoredOct 14, 2026JuniperADV-juniper-c8ea99ccb9182026-10 Security Bulletin: Junos OS Evolved: Multiple vulnerabilities resolved
- –UnscoredOct 14, 2026JuniperADV-juniper-8cc14489e9342026-10 Security Bulletin: Junos OS: MX Series: Multiple vulnerabilities resolved
- –UnscoredOct 14, 2026JuniperADV-juniper-0864bae2a5912026-10 Security Bulletin: Junos OS: Multiple vulnerabilities resolved
- –UnscoredOct 14, 2026JuniperADV-juniper-26bdaa8e857c2026-10 Security Bulletin: Junos OS and Junos OS Evolved: Multiple vulnerabilities resolved
- –UnscoredOct 14, 2026JuniperADV-juniper-543a1123dfec2026-10 Security Bulletin: Junos OS and Junos OS Evolved: SRX Series: Multiple vulnerabilities resolved
- –UnscoredOct 14, 2026JuniperADV-juniper-17759e39c9342026-10 Security Bulletin: Juniper Cloud-Native Router: Multiple vulnerabilities resolved in 26.2 release
- –UnscoredSep 4, 2026JuniperADV-juniper-47f64762c3c52021-04 Security Bulletin: Junos OS and Junos OS Evolved: Multiple NTP vulnerabilities resolved.
- 5.5MediumApr 9, 2026Juniper junos Denial of serviceCVE-2026-33786An Improper Check for Unusual or Exceptional Conditions vulnerability in the chassis control daemon (chassisd) of Juniper Networks Junos OS on SRX1600, SRX2300 and SRX4300 allows a local attacker with low privileges to cause a complete Denial of Service (DoS). When a specific 'show chassis' CLI command is executed, chassisd crashes and restarts which causes a momentary impact to all traffic until all modules are online again. This issue affects Junos OS on SRX1600, SRX2300 and SRX4300: *
- 9.8CriticalDec 19, 2015Juniper ScreenOS Auth bypass / access controlCVE-2015-7755Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device.Exploited61% likelyExploit codeMetasploitDetection
- 4.4MediumMar 12, 2025Juniper Junos OSCVE-2025-21590Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.Exploited1.7% likely
- 5.3MediumAug 17, 2023Juniper Junos OSCVE-2023-36844Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities.Exploited90% likelyExploit codeNucleiDetection
- 9.8CriticalAug 17, 2023Juniper Junos OSCVE-2023-36845Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.Exploited95% likelyExploit codeMetasploit · NucleiDetection
- 5.3MediumAug 17, 2023Juniper Junos OS Auth bypass / access controlCVE-2023-36846Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.Exploited93% likelyDetection
- 5.3MediumAug 17, 2023Juniper Junos OS Auth bypass / access controlCVE-2023-36847Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.Exploited83% likelyDetection
- 5.3MediumSep 26, 2023Juniper Junos OS Auth bypass / access controlCVE-2023-36851Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.Exploited1.1% likely
- 8.8HighMay 4, 2020Juniper Junos OS Path traversal / file handlingCVE-2020-1631A path traversal vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform remote code execution.Exploited4.9% likely
Top products
- junos1 CVE in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- Juniper SIRT · Oct 28, 20262026-10 On-Demand Security Bulletin: Session Smart Router and Session Smart Conductor: Multiple internally discovered vulnerabilities resolvedADV-juniper-6fedcc071f90
- Juniper SIRT · Oct 14, 20262026-10 Security Bulletin: Junos OS Evolved: Multiple vulnerabilities resolvedADV-juniper-c8ea99ccb918
- Juniper SIRT · Oct 14, 20262026-10 Security Bulletin: Junos OS: MX Series: Multiple vulnerabilities resolvedADV-juniper-8cc14489e934
- Juniper SIRT · Oct 14, 20262026-10 Security Bulletin: Junos OS and Junos OS Evolved: SRX Series: Multiple vulnerabilities resolvedADV-juniper-543a1123dfec
- Juniper SIRT · Oct 14, 20262026-10 Security Bulletin: Junos OS and Junos OS Evolved: Multiple vulnerabilities resolvedADV-juniper-26bdaa8e857c
- Juniper SIRT · Oct 14, 20262026-10 Security Bulletin: Juniper Cloud-Native Router: Multiple vulnerabilities resolved in 26.2 releaseADV-juniper-17759e39c934
- Juniper SIRT · Oct 14, 20262026-10 Security Bulletin: Junos OS: Multiple vulnerabilities resolvedADV-juniper-0864bae2a591
- Juniper SIRT · Sep 4, 20262021-04 Security Bulletin: Junos OS and Junos OS Evolved: Multiple NTP vulnerabilities resolved.ADV-juniper-47f64762c3c5
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.