JO
Network Security
Junos OS
On CISA KEVExploited in the wild
931
CVEs
8
On KEV
10.0
Max CVSS
141
New 30D
Severity mix
Critical 52High 392Medium 56Low 0
Watch
Add Junos OS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-36845 In wildKEV | 9.8 | Aug 17 | Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable Affected: before 20.4R3-S9; 21.1 before 21.1*; 21.2 before 21.2R3-S7; 21.3 before 21.3R3-S5; 21.4 before 21.4R3-S5; 22.1 before 22.1R3-S4; +4 more |
| CVE-2020-1631 In wildKEV | 9.8 | May 4 | Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services Affected: 12.3 before 12.3R12-S16; 12.3X48 before 12.3X48-D101, 12.3X48-D105; 14.1X53 before 14.1X53-D54; 15.1 before 15.1R7-S7; 15.1X49 before 15.1X49-D211, 15.1X49-D220; 16.1 before 16.1R7-S8; +12 more |
| CVE-2021-31384 | 10.0 | Oct 19 | Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Networks Junos OS on… Affected: 20.4; 20.4; 20.4; 21.1 |
| CVE-2021-0248 | 10.0 | Apr 22 | This issue is not applicable to NFX NextGen Software Affected: before 19.1; 19.1 |
| CVE-2021-0211 | 10.0 | Jan 15 | An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing Protocol Daemon (RPD) service allows an attacker to send a valid… Affected: 17.3; 17.3; 17.3; 17.3; 17.3; 17.3; +34 more |
| CVE-2020-1614 | 10.0 | Apr 8 | A Use of Hard-coded Credentials vulnerability exists in the NFX250 Series for the vSRX Virtual Network Function (VNF) instance, which allows an attacker to take control of the… Affected: before 19.2; 19.2; 19.2; 19.2; 19.2 |
| CVE-2019-0007 | 10.0 | Jan 15 | Junos OS: vMX series: Predictable IP ID sequence numbers vulnerability Affected: 15.1 before 15.1F5 |
| CVE-2020-1660 | 9.9 | Oct 16 | When DNS filtering is enabled on Juniper Networks Junos MX Series with one of the following cards MS-PIC, MS-MIC or MS-MPC, an incoming stream of packets processed by the… Affected: 17.3; 17.3; 17.3; 17.3; 17.3; 17.3; +34 more |
| CVE-2026-101954 | 9.8 | Oct 14 | Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled Affected: 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; 26.2 before 26.2R1-S2 |
| CVE-2026-101983 | 9.8 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes remote code execution when J-Web virtual-domain is configured Affected: 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; 26.2 before 26.2R1-S2 |
| CVE-2026-101982 | 9.8 | Oct 14 | Junos OS and Junos OS Evolved: A EVPN peer causes an rpd crash or root-level compromise when EVPN-VPWS is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-33796 | 9.8 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP route monitoring is enabled Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-33792 | 9.8 | Oct 14 | Junos OS: SRX Series: An attacker causes remote code execution and denial of service when a GRE tunnel is configured Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-33789 | 9.8 | Oct 14 | Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a specifically crafted BGP route update results in denial of service Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102182 | 9.8 | Oct 14 | Junos OS: MX Series: Certificate-based IKE packets cause root-level code execution Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102178 | 9.8 | Oct 14 | Junos OS and Junos OS Evolved: When BGP update-threading is enabled a specifically malformed flowspec NLRI causes routing-engine compromise Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-102175 | 9.8 | Oct 14 | Junos OS and Junos OS Evolved: An attacker causes remote code execution or denial of service when service-deployment processing is used Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-101990 | 9.8 | Oct 14 | Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re-advertised Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-101950 | 9.8 | Oct 14 | Junos OS: SRX Series: Malformed IPv4 packets cause packet-forwarding process crash when Secure Vector Routing is enabled Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-101986 | 9.8 | Oct 14 | Junos OS and Junos OS Evolved: J-Web permits pre-authentication CGI execution Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2026-101956 | 9.8 | Oct 14 | Junos OS: Unauthorized root command execution when J-Web is enabled Affected: 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; 26.2 before 26.2R1-S2 |
| CVE-2026-101980 | 9.8 | Oct 14 | Junos OS: Malformed Extended Echo requests cause a Routing Engine reboot when Extended Echo is enabled Affected: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; +1 more |
| CVE-2024-21591 | 9.8 | Jan 12 | An Out-of-bounds Write vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to cause a Denial of… Affected: before 20.4; 20.4; 20.4; 20.4; 20.4; 20.4; +34 more |
| CVE-2023-28962 | 9.8 | Apr 17 | An Improper Authentication vulnerability in upload-file.php, used by the J-Web component of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to upload… Affected: before 19.4; 19.4; 19.4; 19.4; 19.4; 19.4; +34 more |
| CVE-2022-22241 | 9.8 | Oct 18 | Junos OS: Vulnerability in J-Web may allow deserialization without authentication Affected: before 19.1R3-S9; 19.2 before 19.2R3-S6; 19.3 before 19.3R3-S7; 19.4 before 19.4R2-S7, 19.4R3-S9; 20.1 before 20.1R3-S5; 20.2 before 20.2R3-S5; +7 more |
| CVE-2022-22167 | 9.8 | Jan 19 | A traffic classification vulnerability in Juniper Networks Junos OS on the SRX Series Services Gateways may allow an attacker to bypass Juniper Deep Packet Inspection (JDPI) rules… Affected: 18.4; 18.4; 18.4; 18.4; 18.4; 18.4; +34 more |
| CVE-2021-0266 | 9.8 | Apr 22 | The use of multiple hard-coded cryptographic keys in cSRX Series software in Juniper Networks Junos OS allows an attacker to take control of any instance of a cSRX deployment… Affected: 20.2; 20.2; 20.2; 20.2; 20.3; 20.3; +2 more |
| CVE-2021-0254 | 9.8 | Apr 22 | A buffer size validation vulnerability in the overlayd service of Juniper Networks Junos OS may allow an unauthenticated remote attacker to send specially crafted packets to the… Affected: 15.1; 15.1; 15.1; 15.1; 15.1; 15.1; +34 more |
| CVE-2021-0249 | 9.8 | Apr 22 | On SRX Series devices configured with UTM services a buffer overflow vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS may allow an attacker to… Affected: 15.1x49; 15.1x49; 15.1x49; 15.1x49; 15.1x49; 15.1x49; +34 more |
| CVE-2020-1654 | 9.8 | Jul 17 | On Juniper Networks SRX Series with ICAP (Internet Content Adaptation Protocol) redirect service enabled, processing a malformed HTTP message can lead to a Denial of Service (DoS)… Affected: 18.1; 18.1; 18.1; 18.1; 18.1; 18.1; +34 more |
| CVE-2020-1647 | 9.8 | Jul 17 | On Juniper Networks SRX Series with ICAP (Internet Content Adaptation Protocol) redirect service enabled, a double free vulnerability can lead to a Denial of Service (DoS) or… Affected: 18.1; 18.1; 18.1; 18.1; 18.1; 18.1; +34 more |
| CVE-2020-1615 | 9.8 | Apr 8 | The factory configuration for vMX installations, as shipped, includes default credentials for the root account Affected: 17.1; 17.1; 17.1; 17.1; 17.1; 17.1; +34 more |
| CVE-2020-10188 | 9.8 | Mar 6 | utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the… Affected: 12.3; 12.3; 12.3; 12.3; 12.3; 12.3; +34 more |
| CVE-2019-0036 | 9.8 | Apr 10 | When configuring a stateless firewall filter in Junos OS, terms named using the format "internal-n" (e.g Affected: 15.1; 15.1; 15.1; 15.1; 15.1; 15.1; +34 more |
| CVE-2019-0008 | 9.8 | Apr 10 | A certain sequence of valid BGP or IPv6 BFD packets may trigger a stack based buffer overflow in the Junos OS Packet Forwarding Engine manager (FXPC) process on QFX5000 series,… Affected: 15.1x53 before 15.1x53-d235; 17.1 before 17.1r3; 17.2 before 17.2r3; 17.3 before 17.3r3-s2; 17.4 before 17.4r2-s1; 18.1 before 18.1r3-s1; +7 more |
| CVE-2019-0002 | 9.8 | Jan 15 | Junos OS: EX2300 and EX3400 series: Certain stateless firewall filter rules might not take effect Affected: 15.1X53 before 15.1X53-D590; 18.1 before 18.1R3; 18.2 before 18.2R2 |
| CVE-2019-0006 | 9.8 | Jan 15 | Junos OS: EX, QFX and MX series: Packet Forwarding Engine manager (FXPC) process crashes due to a crafted HTTP packet in a Virtual Chassis configuration Affected: 14.1X53 before 14.1X53-D47; 15.1X53 before 15.1X53-D50; 15.1 before 15.1R7-S3 |
| CVE-2018-0037 | 9.8 | Jul 11 | Junos OS routing protocol daemon (RPD) process may crash and restart or may lead to remote code execution while processing specific BGP NOTIFICATION messages Affected: 15.1; 15.1; 15.1; 15.1; 15.1; 15.1; +2 more |
| CVE-2018-0035 | 9.8 | Jul 11 | QFX5200 and QFX10002 devices that have been shipped with Junos OS 15.1X53-D21, 15.1X53-D30, 15.1X53-D31, 15.1X53-D32, 15.1X53-D33 and 15.1X53-D60 or have been upgraded to these… Affected: 15.1x53; 15.1x53; 15.1x53; 15.1x53; 15.1x53; 15.1x53 |
| CVE-2018-0007 | 9.8 | Jan 10 | An unauthenticated network-based attacker able to send a maliciously crafted LLDP packet to the local segment, through a local segment broadcast, may be able to cause a Junos… Affected: 12.1x46; 12.1x46; 12.1x46; 12.1x46; 12.1x46; 12.1x46; +34 more |
| CVE-2018-0001 | 9.8 | Jan 10 | A remote, unauthenticated attacker may be able to execute code by exploiting a use-after-free defect found in older versions of PHP through injection of crafted data via specific… Affected: 12.1x46; 12.1x46; 12.1x46; 12.1x46; 12.1x46; 12.1x46; +34 more |
| CVE-2017-10615 | 9.8 | Oct 13 | A vulnerability in the pluggable authentication module (PAM) of Juniper Networks Junos OS may allow an unauthenticated network based attacker to potentially execute arbitrary code… Affected: 14.1; 14.1; 14.1; 14.1; 14.1; 14.1; +23 more |
| CVE-2017-2345 | 9.8 | Jul 17 | On Junos OS devices with SNMP enabled, a network based attacker with unfiltered access to the RE can cause the Junos OS snmpd daemon to crash and restart by sending a crafted SNMP… Affected: 12.1x46; 12.1x46; 12.1x46; 12.1x46; 12.1x46; 12.1x46; +34 more |
| CVE-2017-2343 | 9.8 | Jul 17 | The Integrated User Firewall (UserFW) feature was introduced in Junos OS version 12.1X47-D10 on the Juniper SRX Series devices to provide simple integration of user profiles on… Affected: 12.3x48; 12.3x48; 12.3x48; 12.3x48; 12.3x48; 12.3x48; +2 more |
| CVE-2017-10601 | 9.8 | Jul 17 | A specific device configuration can result in a commit failure condition Affected: 12.3; 12.3; 12.3; 12.3; 12.3; 12.3; +34 more |
| CVE-2016-1279 | 9.8 | Sep 9 | J-Web in Juniper Junos OS before 12.1X46-D45, 12.1X46-D50, 12.1X47 before 12.1X47-D35, 12.3 before 12.3R12, 12.3X48 before 12.3X48-D25, 13.3 before 13.3R10, 13.3R9 before… Affected: through 12.1x46; 12.1x46; 12.1x47; 12.1x47; 12.1x47; 12.1x47; +34 more |
| CVE-2018-0057 | 9.6 | Oct 10 | On MX Series and M120/M320 platforms configured in a Broadband Edge (BBE) environment, subscribers logging in with DHCP Option 50 to request a specific IP address will be assigned… Affected: 15.1; 15.1; 15.1; 15.1; 15.1; 15.1; +21 more |
| CVE-2022-22157 | 9.3 | Jan 19 | A traffic classification vulnerability in Juniper Networks Junos OS on the SRX Series Services Gateways may allow an attacker to bypass Juniper Deep Packet Inspection (JDPI) rules… Affected: 18.4; 18.4; 18.4; 18.4; 18.4; 18.4; +34 more |
| CVE-2021-0268 | 9.3 | Apr 22 | An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') weakness in J-web of Juniper Networks Junos OS leads to buffer overflows, segment faults,… Affected: 18.1; 18.1; 18.1; 18.1; 18.1; 18.1; +34 more |
| CVE-2013-6014 | 9.3 | Oct 28 | Juniper Junos 10.4 before 10.4S15, 11.4 before 11.4R9, 11.4X27 before 11.4X27.44, 12.1 before 12.1R7, 12.1X44 before 12.1X44-D20, 12.1X45 before 12.1X45-D15, 12.2 before 12.2R6,… Affected: 10.4; 11.4; 11.4x27; 12.1; 12.1x44; 12.1x45; +4 more |
The 500 most important CVEs for this product (exploited first, then by severity)