CVE-2023-36846 is a SRX series missing authentication for critical function vulnerability in Juniper Junos OS. CISA added it to the Known Exploited Vulnerabilities catalogue on 13 November 2023, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
What this vulnerability means in practice
A missing authentication for a critical function means the device exposes a sensitive operation without proving the caller is authorised first. On security appliances, that can turn a single reachable interface into a direct path to configuration changes, control-plane abuse, or other actions that should never be unauthenticated.
This matters because perimeter devices often sit at high-trust boundaries and are reachable from networks that attackers can scan and probe. When the flaw is in a security gateway or firewall class product, the impact is usually larger than a typical application bug because the device itself may mediate trust for many downstream systems.
How organisations assess exposure
Exposure review starts with a precise asset inventory: which Juniper Junos OS SRX Series systems exist, where they are deployed, and whether any are internet-facing or reachable from untrusted networks. For version and patch details, readers should rely on the vendor advisory and the CVE Program record, rather than trying to infer scope from the CVE title alone.
Because CISA placed this CVE in the Known Exploited Vulnerabilities catalogue on 13 November 2023, exposure assessment should assume active adversary interest until remediated. That makes internet exposure, remote management access, and any public service paths especially important to review alongside the vendor’s published guidance.
For wider vulnerability context and record lookup, the NIST National Vulnerability Database is the most useful companion source for tracking the CVE entry and correlating it with local asset records.
Remediation and compensating controls
The primary response is to apply the vendor fix or mitigation as a priority. Where patching is delayed, reduce exposure by restricting access to management interfaces, tightening network reachability, and removing unnecessary routes into the affected appliance.
Compensating controls matter most when a perimeter product cannot be taken offline immediately. In that case, organisations should harden adjacent access paths, review segmentation assumptions, and minimise which operators or systems can reach the vulnerable function until the device is updated.
The Vulnerability Management Guide is useful here because prioritisation for KEV-listed issues should be driven by asset criticality, exposure, and remediation verification, not by raw CVE volume.
Detection and compromise review
For a CVE that has been exploited in the wild, post-fix review is as important as patching. Teams should inspect logs, configuration history, management access, and any unexpected administrative actions around the exposure window, then confirm whether the device was used as an initial foothold or pivot point.
If compromise is suspected, review adjacent trust relationships too, because perimeter appliances often carry credentials, routes, or policy relationships that attackers can leverage after initial access. The question is not only whether the bug was exploited, but whether the device was used to change control, intercept traffic, or stage a broader intrusion.
For generalised attack-path thinking and exploit behaviour, the MITRE ATT&CK Enterprise Matrix helps map what to hunt for after unauthorised access through an exposed appliance.
Risk and Threat Considerations
Exploited authentication failures on edge appliances are dangerous because they can give an attacker trusted foothold on a system that is already positioned to protect or route traffic for the rest of the environment. Once that boundary device is compromised, the blast radius can extend far beyond the appliance itself.
Failure mechanism: An attacker reaches the exposed function, performs an action without authenticating, and then uses the appliance’s privileged position to alter traffic, access management functions, or move toward adjacent systems.
Impact: The result can include initial access, policy tampering, traffic interception, lateral movement, and loss of confidence in the device as a security boundary.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Critical function access should require proven user identity before privileged actions. |
| AC-4 — Information Flow Enforcement | Perimeter appliances govern trusted flows, which this flaw can subvert. | |
| SI-2 — Flaw Remediation | This CVE requires urgent remediation and verification after exploitation is known. | |
| Recommendation — Enforce strong authentication before any administrative or control-plane function is allowed. Constrain management and traffic paths so a compromised appliance cannot freely alter flow. Prioritise patching, mitigation, and validation for exploited vulnerabilities. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | The page centres on exposure assessment, prioritisation, and remediation of an exploited CVE. |
| Recommendation — Track KEV-listed flaws, validate exposure, and drive timely remediation. | ||
| MITRE ATT&CK | T1190 — Exploit Public-Facing Application | A network-reachable critical function on an edge device fits public-facing exploitation behaviour. |
| Recommendation — Map exposed appliance exploitation to T1190 and hunt for initial-access activity. | ||
Practitioner Guidance
Why practitioners should care: Treat KEV-listed edge-device CVEs as operationally urgent, especially when they affect devices that terminate remote access or enforce segmentation. The main decision is not whether the bug is interesting, but whether the organisation can tolerate the device remaining exposed even briefly.
What to watch for: Prioritise any sign of unexplained administrative change, new accounts or sessions, unusual management-plane traffic, or configuration drift around the vulnerable window. If those signals exist, remediation should be paired with a compromise review rather than treated as a routine patch cycle.
Practitioner takeaway: For edge appliances, patching and verification should be treated as one security action, because an exploited boundary device can become both the entry point and the persistence layer.
Related resources from NHI Mgmt Group
- CVE-2023-28461 (Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function)
- CVE-2023-27532 (Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function)
- CVE-2025-32433 (Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function)
- CVE-2026-20253 (Splunk Enterprise Missing Authentication for Critical Function)