What it is
A path traversal vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform remote code execution.
What to do
Apply updates per vendor instructions.
Vendor notices and references
Description and required action as published by CISA. Full record at NVD.
Other Juniper entries on the list
- ScreenOS Juniper ScreenOS Improper Authentication Vulnerability CVE-2015-7755 · Oct 2, 2025
- Junos OS Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability CVE-2025-21590 · Mar 13, 2025
- Junos OS Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability CVE-2023-36851 · Nov 13, 2023
- Junos OS Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability CVE-2023-36847 · Nov 13, 2023
- Junos OS Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability CVE-2023-36846 · Nov 13, 2023
- Junos OS Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability CVE-2023-36845 · Nov 13, 2023