CISA KEV + NVD
Juniper flaws exploited in the wild
8 Juniper vulnerabilities CISA lists as used by attackers, each with when it was published, NVD’s severity score, how many days passed between NVD publication and CISA’s KEV listing, and the vendor’s advisory where CISA links one. Catalog version 2026.10.20.
Most Juniper rows are Junos OS, which runs on SRX firewalls and also on EX switches and MX routers; two (CVE-2023-36844, CVE-2023-36847) affect EX switches only. CVE-2015-7755 is ScreenOS, used on older NetScreen and SSG firewalls.
In numbers
- 8 exploited flaws, listed from 25 Mar 2022 to 2 Oct 2025
- 0 used in ransomware campaigns
- 3 scored critical by NVD
- 88 days: median gap between NVD publication and the KEV listing; 1 were listed within a week
All exploited Juniper flaws, newest first
| Vulnerability | Product | Published | Added to KEV | CVSS | Advisory |
|---|---|---|---|---|---|
| CVE-2015-7755Juniper ScreenOS Improper Authentication Vulnerability | ScreenOS | 19 Dec 2015 | 2 Oct 20253575 days later | 9.8 Critical | Vendor |
| CVE-2025-21590Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability | Junos OS | 12 Mar 2025 | 13 Mar 20251 day later | 4.4 Medium | Vendor |
| CVE-2023-36851Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability | Junos OS | 27 Sep 2023 | 13 Nov 202347 days later | 5.3 Medium | Vendor |
| CVE-2023-36847Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability | Junos OS | 17 Aug 2023 | 13 Nov 202388 days later | 5.3 Medium | Vendor |
| CVE-2023-36846Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability | Junos OS | 17 Aug 2023 | 13 Nov 202388 days later | 5.3 Medium | Vendor |
| CVE-2023-36845Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability | Junos OS | 17 Aug 2023 | 13 Nov 202388 days later | 9.8 Critical | Vendor |
| CVE-2023-36844Juniper Junos OS EX Series PHP External Variable Modification Vulnerability | Junos OS | 17 Aug 2023 | 13 Nov 202388 days later | 5.3 Medium | Vendor |
| CVE-2020-1631Juniper Junos OS Path Traversal Vulnerability | Junos OS | 4 May 2020 | 25 Mar 2022690 days later | 9.8 Critical | — |
What to do
- Match the product and version on your appliance against the vendor advisory linked in the row (where none is shown, use the references on the NVD page), and install the fixed release it names.
- CISA’s required action is to apply the vendor’s updates or mitigations, or stop using the product where none exist; recent entries add CISA’s own hunt or forensic-triage steps, and end-of-life products are to be disconnected. US federal civilian agencies must act by a deadline; everyone else faces the same risk.
- Keep the management interface and the VPN portal off the public internet where you can, and restrict them to known addresses where you cannot.
- A patch does not remove an attacker who got in first. For any flaw on this list, look for the vendor’s or CISA’s guidance on signs of compromise, not just the fix.
How this list is kept
- A row appears when CISA adds the flaw to its Known Exploited Vulnerabilities catalog: attackers are using it, not just able to. The catalog is re-read every week.
- Scope is the perimeter appliance: firewalls, SSL-VPN and remote-access gateways, and the delivery controllers that terminate remote access. Email gateways, sandboxes, management consoles and endpoint tools from the same vendors are left out.
- Publication date and CVSS score are NVD’s. “Days later” counts from NVD publication to the KEV listing; “same day or before NVD” means CISA listed the flaw no later than NVD published it. The catalog began on 3 Nov 2021, so older flaws listed that day count to the catalog’s start, not to when exploitation was first reported; the medians leave them out.
- “Used in ransomware” is CISA’s own field, set when a ransomware campaign is known to have used the flaw. How the data pages are built.