# Juniper Junos OS: 5 exploited vulnerabilities · pwn.watch > Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities. Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code. Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. Added to CISA KEV on 2023-11-13. Page: https://pwn.watch/i/juniper-junos-os-cve-2023-36844-and-4-more · generated 2026-10-22T22:00:08.805Z ## Status - Severity: critical · status: closed · patch: patched - Product: Juniper Junos OS - Started: 2023-11-13 · closed: 2023-11-13 - CVEs: CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, CVE-2023-36847, CVE-2023-36851 - Affected: See vendor advisory / CISA notes (versions not always listed in KEV feed) - Fixed in: See vendor advisory linked in sources ## Follow this incident - RSS (one item per update): https://pwn.watch/i/juniper-junos-os-cve-2023-36844-and-4-more/feed.xml - JSON Feed: https://pwn.watch/i/juniper-junos-os-cve-2023-36844-and-4-more/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/juniper-junos-os-cve-2023-36844-and-4-more.json - This file: https://pwn.watch/i/juniper-junos-os-cve-2023-36844-and-4-more/llms.txt ## Updates (newest first) - 2023-11-13: CISA added CVE-2023-36844 to the KEV catalog (due 2023-11-17). - 2023-11-13: CISA added CVE-2023-36845 to the KEV catalog (due 2023-11-17). - 2023-11-13: CISA added CVE-2023-36846 to the KEV catalog (due 2023-11-17). - 2023-11-13: CISA added CVE-2023-36847 to the KEV catalog (due 2023-11-17). - 2023-11-13: CISA added CVE-2023-36851 to the KEV catalog (due 2023-11-17). ## Fix brief # Security brief: Juniper Junos OS: 5 exploited vulnerabilities Source: https://pwn.watch/i/juniper-junos-os-cve-2023-36844-and-4-more · status: closed (closed Nov 13, 2023) · severity: critical · updated Nov 13, 2023 ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities. Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code. Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. Added to CISA KEV on 2023-11-13. Severity detail: CVSS 9.8 (NVD), actively exploited (CISA KEV) - Product: Juniper Junos OS - CVE / advisory ids: CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, CVE-2023-36847, CVE-2023-36851 ## Affected versions - See vendor advisory / CISA notes (versions not always listed in KEV feed) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - See vendor advisory linked in sources After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Nov 13, 2023: CISA added CVE-2023-36844 to the KEV catalog (due 2023-11-17). - Nov 13, 2023: CISA added CVE-2023-36845 to the KEV catalog (due 2023-11-17). - Nov 13, 2023: CISA added CVE-2023-36846 to the KEV catalog (due 2023-11-17). - Nov 13, 2023: CISA added CVE-2023-36847 to the KEV catalog (due 2023-11-17). - Nov 13, 2023: CISA added CVE-2023-36851 to the KEV catalog (due 2023-11-17). ## Advisories - [Vendor advisory: Juniper Junos OS](https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US) (Juniper) - [NVD: CVE-2023-36844](https://nvd.nist.gov/vuln/detail/CVE-2023-36844) (NVD) - [NVD: CVE-2023-36845](https://nvd.nist.gov/vuln/detail/CVE-2023-36845) (NVD) - [NVD: CVE-2023-36846](https://nvd.nist.gov/vuln/detail/CVE-2023-36846) (NVD) - [NVD: CVE-2023-36847](https://nvd.nist.gov/vuln/detail/CVE-2023-36847) (NVD) - [NVD: CVE-2023-36851](https://nvd.nist.gov/vuln/detail/CVE-2023-36851) (NVD) - [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (CISA) ## Caveats Derived from CISA KEV JSON feed catalogVersion 2026.10.21. Exact affected/fixed version strings are not always in the KEV record — verify against the vendor advisory URL. startedAt uses dateAdded (exploitation may have begun earlier). Grouped: same vendor/product added to KEV on the same day. --- Machine-readable: https://pwn.watch/i/juniper-junos-os-cve-2023-36844-and-4-more.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.