Junos vulnerabilitiesAnd the versions its exploited flaws hit.
Junos is made by Juniper. We track 646 published vulnerabilities listed under that exact name, across 209 versions. 7 of them are on the list of flaws known to be exploited, the newest added on 13 March 2025. Juniper lists newer releases under their own names, such as Junos OS Evolved, so check those pages too.
The most recent Junos flaw added to the known-exploited list is CVE-2025-21590, on 13 March 2025. We keep watching the known-exploited list.
Is Junos listed under other names? Yes.
Juniper also lists Junos under more specific names, such as Junos OS Evolved and Junos Space. Flaws listed only under those names are counted on their own pages, not here. If you run one of these, open its page for its own exploited flaws.
- Junos OS Evolved157 published vulnerabilities
- Junos Space50 published vulnerabilities
- Junos Space Ja1500 Appliance6 published vulnerabilities
- Junos Pulse Secure Access Service5 published vulnerabilities
- Junos Space Virtual Appliance4 published vulnerabilities
- Junos Pulse Access Control Service3 published vulnerabilities
- Junos E2 published vulnerabilities
- Junos Space Ja2500 Appliance2 published vulnerabilities
- Junos M1 published vulnerability
- Junos T1 published vulnerability
- Junos J1 published vulnerability
- Junos Pulse Client1 published vulnerability
Which versions of Junos do the exploited flaws hit?
Each exploited flaw lists the versions it affects, usually as ranges. "before 20.4" means every version up to, but not including, 20.4. Find your version, then patch.
- CVE-2025-21590Exploited list, 13 Mar 2025
Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability
up to 21.221.2-r121.2-r1-s121.2-r1-s221.2-r221.2-r2-s121.2-r2-s221.2-r3 - CVE-2023-36844Exploited list, 13 Nov 2023
Juniper Junos OS EX Series PHP External Variable Modification Vulnerability
before 20.420.420.4-r120.4-r1-s120.4-r220.4-r2-s120.4-r2-s220.4-r3 - CVE-2023-36845Exploited list, 13 Nov 2023
Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability
before 20.420.420.4-r120.4-r1-s120.4-r220.4-r2-s120.4-r2-s220.4-r3 - CVE-2023-36847Exploited list, 13 Nov 2023
Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability
before 20.420.420.4-r120.4-r1-s120.4-r220.4-r2-s120.4-r2-s220.4-r3 - CVE-2023-36851Exploited list, 13 Nov 2023
Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
21.221.2-r121.2-r1-s121.2-r1-s221.2-r221.2-r2-s121.2-r2-s221.2-r3 - CVE-2023-36846Exploited list, 13 Nov 2023
Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
before 20.420.420.4-r120.4-r1-s120.4-r220.4-r2-s120.4-r2-s220.4-r3 - CVE-2020-1631Exploited list, 25 Mar 2022
Juniper Junos OS Path Traversal Vulnerability
12.312.3-r112.3-r1012.3-r10-s112.3-r10-s212.3-r1112.3-r1212.3-r12-s1
Which Junos vulnerabilities are being exploited?
7 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 4.4Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability
Juniper Junos OS contains an improper isolation or compartmentalization vulnerability.
- 5.3Juniper Junos OS EX Series PHP External Variable Modification Vulnerability
Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables.
- 9.8Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability
Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable.
- 5.3Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability
Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
- 5.3Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
- 5.3Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
- 8.8Juniper Junos OS Path Traversal Vulnerability
A path traversal vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an...
Which Junos flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 95%
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code.
- 93%
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
- 90%
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.
- 87%CVE-2019-11358Medium
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution.
- 83%
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
- 80%CVE-2004-0230Medium
TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST...
- 74%CVE-2020-10188Critical
utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions.
- 62%CVE-2016-1286High
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to...
- 59%CVE-2016-1285Medium
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion...
- 56%CVE-2014-9708Medium
Embedthis Appweb before 4.6.6 and 5.x before 5.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a Range header with an empty value, as demonstrated by "Range: x=,".
Running Junos? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.
- Matched to
- Junos on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 646 published vulnerabilities listed under the name Junos, across 209 versions. The most recent Junos flaw added to the known-exploited list is CVE-2025-21590, on 13 March 2025.
7 are on the list of flaws known to be exploited. The most recently added are CVE-2025-21590, CVE-2023-36844 and CVE-2023-36845.
Juniper also lists Junos under more specific names, such as Junos OS Evolved and Junos Space. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.
Each flaw names its own versions, usually as ranges. The newest, CVE-2025-21590, affects up to 21.2, 21.2-r1, 21.2-r1-s1, 21.2-r1-s2 and more. The versions for every exploited flaw are listed on this page.
Create a Precursor Intelligence account and track Junos. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.