CVE-2023-36845

CRITICAL9.8

CISA KEV

Published 2023-08-17 · Updated 2026-06-17 · Source sirt@juniper.net

Summary

CVE-2023-36845 is a critical-severity (CVSS 9.8) vulnerability in Juniper Junos OS. CISA added it to the Known Exploited Vulnerabilities catalog on November 13, 2023, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by November 17, 2023. CISA does not currently list it as used in ransomware campaigns. Juniper has 8 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

All 8 known-exploited Juniper vulnerabilities →

Description

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code. This issue affects Juniper Networks Junos OS on EX Series and SRX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R2-S2, 22.3R3-S1; * 22.4 versions prior to 22.4R2-S1, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-473

CISA Known-Exploited Vulnerability

Product: Juniper — Junos OS

Name: Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability

Date added: 2023-11-13 · Due: 2023-11-17

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

References

View on NVD

More exploited Juniper vulnerabilities

Most recently added to CISA KEV

CVE-2015-7755
ScreenOS — Juniper ScreenOS Improper Authentication Vulnerability
added 2025-10-02
CVE-2025-21590
Junos OS — Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability
added 2025-03-13
CVE-2023-36844
Junos OS — Juniper Junos OS EX Series PHP External Variable Modification Vulnerability
added 2023-11-13
CVE-2023-36846
Junos OS — Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
added 2023-11-13
CVE-2023-36847
Junos OS — Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability
added 2023-11-13
CVE-2023-36851
Junos OS — Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
added 2023-11-13

View all →

Related CVEs

Same severity, most recent

CVE-2026-58490
Tracecat is an open-source security automation platform for teams and AI agents. From version 0.37.0 until 1.0.0-beta.49, Docker Compose deployments with SAML enabled can render SAML_SIGNED_ASSERTIONS and SAML_SIGNED_RESPONSES as empty values, overriding secure application defaults and disabling both signature requirements. An unauthenticated attacker who can reach the SAML assertion consumer endpoint can submit a forged unsigned response for an existing Tracecat user email address and obtain that user’s session. Targeting an existing superadmin can result in superadmin account takeover. Exploitation does not create users when SAML user creation is disabled and does not affect default Fargate or Helm deployments. Version 1.0.0-beta.49 removes the insecure deployment pass-through and requires signed assertions and responses.
2026-11-06 · score 9.8
CVE-2026-71495
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.
2026-11-06 · score 10.0
CVE-2026-119923
A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a specially crafted malformed TDS prelogin packet to the TDS port. This record consolidates a related NULL-pointer-dereference finding in the same prelogin parser. To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.
2026-11-06 · score 9.8
CVE-2026-123832
In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database
2026-11-06 · score 9.6
CVE-2026-123831
In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings
2026-11-06 · score 9.6