Juniper flaws being used in attacks
CISA lists 8 flaws in Juniper products as being used in attacks, most recently on 2 Oct 2025.
JuniperBeing used in attacks
- On CISA’s list
- 8 flaws, added between 25 Mar 2022 and 2 Oct 2025
- Most recent
- CVE-2015-7755, Juniper ScreenOS Improper Authentication Vulnerability, added 2 Oct 2025
- Used in ransomware
- None known to CISA
- Products
- Junos OS (7), ScreenOS (1)
What to do
- Update every Juniper product you use.Install the updates Juniper offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
- If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Every flaw, newest first
- Juniper ScreenOS
CVE-2015-7755Juniper ScreenOS Improper Authentication VulnerabilityJuniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Juniper Junos OS
CVE-2025-21590Juniper Junos OS Improper Isolation or Compartmentalization VulnerabilityJuniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Juniper Junos OS
CVE-2023-36851Juniper Junos OS SRX Series Missing Authentication for Critical Function VulnerabilityJuniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Juniper Junos OS
CVE-2023-36847Juniper Junos OS EX Series Missing Authentication for Critical Function VulnerabilityJuniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Juniper Junos OS
CVE-2023-36846Juniper Junos OS SRX Series Missing Authentication for Critical Function VulnerabilityJuniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Juniper Junos OS
CVE-2023-36845Juniper Junos OS EX Series and SRX Series PHP External Variable Modification VulnerabilityJuniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Juniper Junos OS
CVE-2023-36844Juniper Junos OS EX Series PHP External Variable Modification VulnerabilityJuniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Juniper Junos OS
CVE-2020-1631Juniper Junos OS Path Traversal VulnerabilityA path traversal vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform remote code execution.CISA’s required actionApply updates per vendor instructions.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Juniper on CISA’s site.