Junos OS

The US cybersecurity agency CISA lists these vulnerabilities in its catalog of Known Exploited Vulnerabilities. What CISA does not carry does not appear in this list — even where it is being exploited.

• CVE-2020-1631Juniper Junos OS Path Traversal Vulnerability

  9.8 critical · over the network, without login · CISA deadline was 15 Apr 22

• CVE-2023-36845Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability

  9.8 critical · over the network, without login · CISA deadline was 17 Nov 23

• CVE-2023-36851Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability

  5.3 medium · over the network, without login · CISA deadline was 17 Nov 23

• CVE-2023-36847Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability

  5.3 medium · over the network, without login · CISA deadline was 17 Nov 23

• CVE-2023-36846Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability

  5.3 medium · over the network, without login · CISA deadline was 17 Nov 23

• CVE-2023-36844Juniper Junos OS EX Series PHP External Variable Modification Vulnerability

  5.3 medium · over the network, without login · CISA deadline was 17 Nov 23

• CVE-2025-21590Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability

  4.4 medium · locally only, with admin rights only · CISA deadline was 3 Apr 25

Source: CISA KEV. The CVE is matched to the product automatically — when in doubt, the linked NVD entry applies.