Is CVE-2023-36846 actively exploited?

Yes. CVE-2023-36846 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2023-36846 be exploited remotely?

The attack vector of CVE-2023-36846 has not been classified yet.

What is the CVSS score of CVE-2023-36846?

CVE-2023-36846 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2023-36846

HIGHCISA KEVIN THE WILD

CVE-2023-36846

Published: November 13, 2023

EPSS:94.23%probability of exploitation in 30 daysPercentile:99.9th

Official Description

Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.

NVD Source

CISA KEV Advisory

Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability

Added to KEV: 2023-11-13Federal patch deadline: 2023-11-17

Required Action (CISA)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Risk Analysis

Juniper Junos OS on SRX Series has a missing authentication vulnerability in J-Web, allowing an unauthenticated attacker to upload arbitrary files. While initially causing limited file system integrity impact, this flaw can be chained with other vulnerabilities for greater compromise. The high EPSS score of 0.94226 indicates a significant likelihood of exploitation, and it is confirmed to be exploited in the wild.

This vulnerability is actively exploited in the wild. An unauthenticated, network-based attacker can upload arbitrary files via J-Web.

Recommended Action

Apply the latest security patches for Juniper Junos OS on SRX Series. Ensure J-Web is properly secured and restrict access to it.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2023-36846 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2023-36846 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.