Juniper known exploited vulnerabilities

CISA KEV catalog 2026.09.25 (1,726 CVEs) with FIRST EPSS scores from 2026-09-27.

CISA lists 8 Juniper CVEs as exploited in the wild. 1 were added in the last 12 months (latest 2025-10-02), and 0 are known to be used in ransomware campaigns.

Juniper CVEs added to CISA KEV per year

Year = when CISA added the CVE to the catalog (KEV started in November 2021).

Patch first: highest EPSS right now

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days.

CVE-2023-36845 (Junos OS): EPSS 95.1%, added 2023-11-13
CVE-2023-36846 (Junos OS): EPSS 93.5%, added 2023-11-13
CVE-2023-36844 (Junos OS): EPSS 90.0%, added 2023-11-13
CVE-2023-36847 (Junos OS): EPSS 83.5%, added 2023-11-13
CVE-2015-7755 (ScreenOS): EPSS 61.1%, added 2025-10-02

Most affected Juniper products

Junos OS (7), ScreenOS (1).

All Juniper CVEs in KEV

CVE	Product	Flaw	Added	Federal due	EPSS	Ransomware
CVE-2015-7755	ScreenOS	ScreenOS Improper Authentication	2025-10-02	2025-10-23	61.1%	–
CVE-2025-21590	Junos OS	Junos OS Improper Isolation or Compartmentalization	2025-03-13	2025-04-03	1.7%	–
CVE-2023-36851	Junos OS	Junos OS SRX Series Missing Authentication for Critical Function	2023-11-13	2023-11-17	1.1%	–
CVE-2023-36847	Junos OS	Junos OS EX Series Missing Authentication for Critical Function	2023-11-13	2023-11-17	83.5%	–
CVE-2023-36846	Junos OS	Junos OS SRX Series Missing Authentication for Critical Function	2023-11-13	2023-11-17	93.5%	–
CVE-2023-36845	Junos OS	Junos OS EX Series and SRX Series PHP External Variable Modification	2023-11-13	2023-11-17	95.1%	–
CVE-2023-36844	Junos OS	Junos OS EX Series PHP External Variable Modification	2023-11-13	2023-11-17	90.0%	–
CVE-2020-1631	Junos OS	Junos OS Path Traversal	2022-03-25	2022-04-15	4.8%	–

Federal due dates bind US federal civilian agencies (CISA binding operational directives); everyone else can use them as a priority hint. Sources: CISA KEV, FIRST EPSS.