CVE-2023-36846: Juniper Junos OS SRX J-Web Missing Authentication Allows File Upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with confirmed exploitation, has an EPSS probability of 0.9482, and is remotely exploitable without authentication, despite the CVSS score of 5.3.

What it is

Junos OS on SRX Series fails to require authentication for a critical function in user.php reachable through J-Web, letting an unauthenticated network attacker upload arbitrary files. The flaw only yields limited file system integrity impact per the vendor, but it can be chained with other vulnerabilities. It is listed in CISA KEV, so real-world exploitation is confirmed.

Impact

An attacker can write arbitrary files to part of the SRX file system without credentials. That integrity loss is limited on its own but provides a foothold for chaining into more severe compromise.

Attack surface

Reachable over the network via a specific request to user.php in J-Web; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CISA added it to KEV on 2023-11-13 with a 2023-11-17 remediation due date, and EPSS is 0.9482 (99.855th percentile), indicating active exploitation and high likelihood. No ransomware campaign use is recorded.

What to do

• Upgrade Junos OS on SRX Series to a fixed release: 20.4R3-S8 or later, 21.2R3-S6 or later, 21.3R3-S5 or later, 21.4R3-S5 or later, 22.1R3-S3 or later, 22.2R3-S2 or later, 22.3R2-S2/22.3R3 or later, or 22.4R2-S1/22.4R3 or later.
• If immediate patching is not possible, disable or restrict J-Web access per vendor guidance and discontinue use if no mitigation is available, as CISA directs.
• Restrict network access to J-Web management interfaces to trusted administrative networks only.
• Monitor for and investigate unexpected files or changes in the SRX file system.

Detection

• Inspect J-Web/HTTP logs for unauthenticated requests to user.php, especially POST requests with file upload content.
• Alert on file creation or modification events in the SRX file system outside normal administrative activity.
• Correlate J-Web access from untrusted source IPs with subsequent file system changes or further exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.