Evidence dossier

CVE-2023-36851

Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files

55.3–70.3Priority evidence range

As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9

Normalized restatement

A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of integrity or confidentiality, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on SRX Series: * 21.2 versions prior to 21.2R3-S8; * 21.4 versions prior to 21.4R3-S6; * 22.1 versions prior to 22.1R3-S5; * 22.2 versions prior to 22.2R3-S3; * 22.3 versions prior to 22.3R3-S2; * 22.4 versions prior to 22,4R2-S2, 22.4R3; * 23.2 versions prior to 23.2R1-S2, 23.2R2.

State: PUBLISHED
Published: Sep 26, 2023
Updated: Oct 21, 2025
Evidence coverage: 85%

CISA KEVCatalog member

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

FIRST EPSS1.09%

2026-07-18 · v2026.06.15 · percentile 61.7%

Source stateNo scored conflict

Distinct CVSS assessments remain side by side; none are averaged.

Source comparison

Who said what

CISA-ADPindependent enrichment

container

CISA ADP Vulnrichment

Jul 19, 2026Original evidence ↗

CVEderivative copy

container

CVE Program Container

Jul 19, 2026Original evidence ↗

juniperoriginal assertion

container

Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files

Jul 19, 2026Original evidence ↗

CISA KEVoriginal assertion

observed_exploitation

Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability

Jul 19, 2026Original evidence ↗

FIRST EPSSoriginal assertion

model_probability

Probability 0.010910000000; percentile 0.616720000000

Jul 19, 2026Original evidence ↗

Applicability

Cited product scope

Trace impact →

Juniper NetworksJunos OS

[{"status": "affected", "version": "21.2", "lessThan": "21.2R3-S8", "versionType": "semver"}, {"status": "affected", "version": "21.4", "lessThan": "21.4R3-S6", "versionType": "semver"}, {"status": "affected", "version": "22.1", "lessThan": "22.1R3-S5", "versionType": "semver"}, {"status": "affected", "version": "22.2", "lessThan": "22.2R3-S3", "versionType": "semver"}, {"status": "affected", "version": "22.3", "lessThan": "22.3R3-S2", "versionType": "semver"}, {"status": "affected", "version": "22.4", "lessThan": "22.4R2-S2, 22.4R3", "versionType": "semver"}, {"status": "affected", "version": "23.2", "lessThan": "23.2R1-S2, 23.2R2", "versionType": "semver"}]

unknown