Juniper Junos OS known exploited vulnerabilities, ranked
CISA lists 7 Juniper Junos OS CVEs as exploited in the wild. 0 were added in the last 12 months and 0 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2023-36845: EPSS 95.1%, added 2023-11-13
- CVE-2023-36846: EPSS 93.5%, added 2023-11-13
- CVE-2023-36844: EPSS 90.0%, added 2023-11-13
- CVE-2023-36847: EPSS 83.5%, added 2023-11-13
- CVE-2020-1631: EPSS 4.8%, added 2022-03-25
All 7 Juniper Junos OS CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2023-36845 | Junos OS EX Series and SRX Series PHP External Variable Modification | 95.1% | – | 2023-11-13 | 2023-11-17 |
| 2 | CVE-2023-36846 | Junos OS SRX Series Missing Authentication for Critical Function | 93.5% | – | 2023-11-13 | 2023-11-17 |
| 3 | CVE-2023-36844 | Junos OS EX Series PHP External Variable Modification | 90.0% | – | 2023-11-13 | 2023-11-17 |
| 4 | CVE-2023-36847 | Junos OS EX Series Missing Authentication for Critical Function | 83.5% | – | 2023-11-13 | 2023-11-17 |
| 5 | CVE-2020-1631 | Junos OS Path Traversal | 4.8% | – | 2022-03-25 | 2022-04-15 |
| 6 | CVE-2025-21590 | Junos OS Improper Isolation or Compartmentalization | 1.7% | – | 2025-03-13 | 2025-04-03 |
| 7 | CVE-2023-36851 | Junos OS SRX Series Missing Authentication for Critical Function | 1.1% | – | 2023-11-13 | 2023-11-17 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Juniper KEV CVEs · free KEV badge for Juniper · all vendors