CVE-2023-36847 is an EX series missing authentication for critical function vulnerability in Juniper Junos OS. CISA added it to the Known Exploited Vulnerabilities catalogue on 13 November 2023, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
What this vulnerability means in a Junos EX environment
Missing authentication for a critical function means the device exposes a high-value action path without sufficient identity checks. On network infrastructure, that can turn a management or control-plane operation into an unauthorised entry point, which is why this class of flaw is dangerous even before any additional privilege escalation is involved.
For operators, the key question is not only whether the device is reachable, but whether the vulnerable function is exposed through a path an attacker can reach. That can include management interfaces, adjacent internal networks, misconfigured administrative access, or any path that allows the protected function to be invoked before the product’s normal trust checks.
Why unauthenticated critical functions are dangerous
When authentication is missing on a critical function, the attacker does not need to break a password flow first. The vulnerability itself removes the control boundary that should separate ordinary traffic from administrative or high-impact device behaviour. In practice, that can let an intruder alter configuration, trigger state changes, or reach functions that were supposed to be reserved for trusted users.
This is especially risky on networking equipment because the device often sits on a privileged trust boundary. If an attacker can invoke a critical function directly, the outcome may extend beyond the appliance itself and affect routing, segmentation, availability, monitoring, or downstream administrative trust.
How organisations check exposure and verify remediation
Exposure review starts with an accurate asset inventory and a clear view of where Junos OS EX Series systems are deployed. Teams should then compare those systems against the vendor advisory and the CISA KEV catalogue, because the public KEV listing confirms this CVE has been observed in real attacks and should be handled as an active exploitation risk.
Validation should focus on whether the affected platform is present, whether the vulnerable path is reachable, and whether the organisation has already applied the vendor fix or mitigation. Where patching is delayed, exposure should be narrowed with compensating controls such as restricting management-plane access, limiting reachability from untrusted networks, and monitoring for attempts to invoke the affected function.
Detection, compromise review, and post-incident checks
After any suspected exposure period, organisations should review logs, configuration history, and device behaviour for signs that the vulnerable function was used unexpectedly. The main objective is to determine whether the device was only exposed, or whether the attacker also used that exposure to change state, persist, or pivot.
If exploitation is confirmed or strongly suspected, the review should extend to the device’s trust relationships. On infrastructure devices, compromise can force a broader investigation into admin access, session validity, configuration integrity, and any credentials or secrets that may have been used to manage the system before or after exploitation.
Risk and Threat Considerations
This CVE is dangerous because attackers do not need to defeat the normal authentication boundary before reaching a critical function. In an edge or management plane context, that can create a direct path to device control, service disruption, or follow-on network compromise.
Failure mechanism: The vulnerable function can be invoked without the expected authentication check, so the device accepts a high-impact action from an untrusted caller.
Impact: An attacker may be able to change device state, undermine administrative trust, or use the appliance as a foothold for broader network impact.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Addresses missing authentication on privileged device functions |
| AC-6 — Least Privilege | Limits the blast radius if an unauthorised critical function is reachable | |
| AU-6 — Audit Review, Analysis, and Reporting | Supports detection and review after suspected misuse of the vulnerable function | |
| Recommendation — Require strong authentication before any critical administrative function is invoked. Restrict who and what can reach management-plane and critical device functions. Review device logs and configuration changes for signs of unauthorised use. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Covers limiting administrative access paths and reachability to exposed functions |
| CIS-8 — Audit Log Management | Supports investigation of exploitation and post-incident review | |
| Recommendation — Remove unnecessary access paths to the affected device and management plane. Preserve and review logs for evidence of unauthorised device interaction. | ||
Practitioner Guidance
Why practitioners should care: Treat this as an exposure-and-control issue, not just a versioning problem. If the device is still in service, the priority is to remove attack reachability first, then confirm the fix or mitigation is actually in place.
What to watch for: Focus on unexpected management activity, unexplained configuration changes, and any evidence that the device was reachable from networks that should not have been able to invoke administrative or critical functions.
Practitioner takeaway: For KEV-listed infrastructure flaws, the safest operating assumption is that reachability plus missing authentication is enough to justify urgent remediation and a post-fix compromise review.
Related resources from NHI Mgmt Group
- CVE-2023-28461 (Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function)
- CVE-2023-27532 (Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function)
- CVE-2025-32433 (Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function)
- CVE-2026-20253 (Splunk Enterprise Missing Authentication for Critical Function)