Juniper Networks Known Exploited Vulnerabilities
Evidence-backed KEV intelligence for Juniper Networks products — CISA KEV status, confidence, sensor telemetry, and virtual-patch availability.
Total KEVs
11
In CISA KEV
8
Beyond CISA KEV
3
Sensor Observed
0
Virtual Patch Available
0
Juniper Networks KEVs Added by Year
11 Juniper Networks KEVs added all time (primary attestation date).
Attested CVEs
| CVE | Product | Confidence | CISA KEV | Added |
|---|---|---|---|---|
|
CVE-2026-21902
Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root |
Junos OS Evolved | High | Not in CISA | 19 Mar 2026 |
|
CVE-2024-21620
Junos OS: SRX Series and EX Series: J-Web doesn't sufficiently sanitize input to prevent XSS |
Junos OS | High | Not in CISA | 07 Mar 2026 |
|
CVE-2022-22242
Junos OS: Cross-site Scripting (XSS) vulnerability in J-Web |
Junos OS | High | Not in CISA | 21 Jul 2025 |
|
CVE-2015-7755
Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before... |
ScreenOS | Confirmed | In CISA | 01 Jun 2026 |
|
CVE-2020-1631
Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services |
Junos OS | Confirmed | In CISA | 25 Mar 2022 |
|
CVE-2023-36851
Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files |
Junos OS | Confirmed | In CISA | 13 Nov 2023 |
|
CVE-2023-36847
Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files |
Junos OS | Confirmed | In CISA | 13 Nov 2023 |
|
CVE-2023-36846
Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files |
Junos OS | Confirmed | In CISA | 13 Nov 2023 |
|
CVE-2023-36845
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable |
Junos OS | Confirmed | In CISA | 13 Nov 2023 |
|
CVE-2023-36844
Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables |
Junos OS | Confirmed | In CISA | 13 Nov 2023 |
|
CVE-2025-21590
Junos OS: An local attacker with shell access can execute arbitrary code |
Junos OS | Confirmed | In CISA | 13 Mar 2025 |
Common Vulnerability Classes (CWE)
- CWE-306 — Missing Authentication for Critical Function 3
- CWE-473 — PHP External Variable Modification 2
- CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 2
- CWE-73 — External Control of File Name or Path 1
- CWE-732 — Incorrect Permission Assignment for Critical Resource 1
- CWE-653 — Improper Isolation or Compartmentalization 1
- CWE-287 — Improper Authentication 1
- CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 1
Browse all known exploited vulnerabilities · What is a known exploited vulnerability? · Methodology