Juniper Networks vulnerabilities

CVEs per yearBy the year they were published

1. 201773
2. 20177
3. 201856
4. 201972
5. 202081
6. 2021134
7. 202295
8. 2023100
9. 2024130
10. 2026234
11. 2026104

Known exploitedNewest addition to KEV first

• CVE-2025-21590

  Junos OS: An local attacker with shell access can execute arbitrary code

  Juniper Networks · Junos OS

  ExploitedMedium6.7
• CVE-2023-36851

  Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files

  Juniper Networks · Junos OS

  ExploitedMedium5.3
• CVE-2023-36846

  Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files

  Juniper Networks · Junos OS

  ExploitedMedium5.3
• CVE-2023-36845

  Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable

  Juniper Networks · Junos OS

  ExploitedCritical9.8
• CVE-2023-36844

  Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables

  Juniper Networks · Junos OS

  ExploitedMedium5.3
• CVE-2023-36847

  Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files

  Juniper Networks · Junos OS

  ExploitedMedium5.3
• CVE-2020-1631

  Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services

  Juniper Networks · Junos OS

  ExploitedHigh8.8

Newest CVEs

• CVE-2026-106079

  Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration

  Juniper Networks · Session Smart Router

  High8.8
• CVE-2026-103411

  Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing

  Juniper Networks · Session Smart Router

  High7.1
• CVE-2026-103410

  Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection

  Juniper Networks · Session Smart Router

  High7.5
• CVE-2026-103409

  Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed

  Juniper Networks · Session Smart Router

  Critical9.8
• CVE-2026-103408

  Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options

  Juniper Networks · Session Smart Router

  High8.8
• CVE-2026-103407

  Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management

  Juniper Networks · Session Smart Router

  High8.8
• CVE-2026-103406

  Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.

  Juniper Networks · Session Smart Conductor

  Critical9.8
• CVE-2026-103405

  Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting

  Juniper Networks · Session Smart Router

  Medium5.8
• CVE-2026-103404

  Session Smart Conductor: Insecure file permissions cause unauthorized access to sensitive routing credentials

  Juniper Networks · Session Smart Conductor

  Medium6.8
• CVE-2026-103403

  Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules

  Juniper Networks · Session Smart Router

  High8.8