Is CVE-2023-36845 (Juniper Junos OS EX Series and SRX Series PHP External Variable Modification) being exploited in the wild?

Yes. CISA added CVE-2023-36845 to its Known Exploited Vulnerabilities catalogue on 13 November 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable.

How this vulnerability can be exploited in practice

CVE-2023-36845 is a Junos OS weakness in EX and SRX series devices where an unauthenticated, network-based attacker can manipulate an important environment variable. That matters because internet-facing appliance flaws often become initial-access paths, especially when the vulnerable service is exposed on a management or application-facing interface. Edge Device Security Guide is useful here because it frames the exposure pattern, logging expectations and patch discipline that determine whether a device stays defensible after disclosure.

The practical question is not just whether code execution is possible, but whether the device can be reached, whether the vulnerable surface is still enabled, and whether other services on the box inherit the same trust boundary. Once a perimeter or management appliance is compromised, attackers typically use it to pivot, harvest configuration material or establish persistence rather than treat it as a one-off crash event.

CVE Program and NIST National Vulnerability Database are the authoritative places to confirm the record, while the vendor advisory should be used for device-specific exposure and remediation details.

What CISA KEV status changes for defenders

CISA KEV listing is operationally significant because it is a signal to treat the issue as active-exploitation risk, not as a routine patch queue item. For this case, the KEV entry means defenders should assume scanning and weaponisation pressure may already exist in the wild, even if they have not yet seen alerts in their own environment.

CISA Known Exploited Vulnerabilities Catalog is the right reference for prioritisation because it ties vulnerability management to confirmed exploitation rather than to severity alone. A complementary way to prioritise is to combine KEV status with FIRST EPSS so remediation order reflects both observed exploitation and likelihood signals.

For teams that manage large estates of network appliances, the important operational shift is that remediation timing becomes a containment decision, not just a hygiene task. Devices that expose administrative or externally reachable services should move ahead of lower-risk backlog items, especially where the appliance sits on a critical trust boundary or supports remote administration.

What to do if patching must wait

If immediate patching is not possible, the priority is to reduce exposure at the edge rather than rely on hope that the flaw will not be reached. That usually means restricting management access, removing unnecessary internet exposure, tightening ACLs, and verifying whether any compensating control actually blocks the vulnerable request path.

Zero-Day and Exploited Vulnerabilities Guide supports the response posture here because it focuses on emergency mitigation, compromise assessment and post-patch hunting when exploitation may already be under way. For broader control design, NIST Cybersecurity Framework 2.0 remains useful for organising protect, detect, respond and recover actions around a high-risk exposed appliance.

In practice, a temporary exception is only defensible when you can show the vulnerable surface is no longer reachable from untrusted networks and the device is being monitored closely enough to detect failed exploitation attempts, configuration drift or unexpected process changes.

Risk and Threat Considerations

Internet-facing Junos appliances are attractive because they sit on a trust boundary and often have visibility into routing, security policy or adjacent infrastructure. If the flaw is reachable before remediation, an attacker may be able to use the device as an entry point for reconnaissance, configuration theft or further movement inside the network.

Failure mechanism: The attacker abuses the vulnerable PHP variable handling to influence device behaviour over the network, which can defeat assumptions that the appliance only processes trusted input.

Impact: The likely consequence is unauthorized device control or broader environmental exposure, especially if the appliance stores credentials, policy state or connectivity details that help with follow-on access.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed appliance flaws require prioritized vulnerability tracking and remediation.
Recommendation — Prioritise and remediate exposed Junos appliances using an active vulnerability management process.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	The issue is a known exploited vulnerability that must be identified and tracked on exposed assets.
Recommendation — Scan for exposed Junos devices and track this CVE to completion.
NIST CSF 2.0	ID.RA-01 — Asset vulnerabilities are identified and recorded	Defenders must identify vulnerable Junos assets before exposure can be reduced.
	PR.PS-01 — Configurations are managed and maintained	Reducing exposure depends on hardening and maintaining appliance configuration.
	DE.CM-01 — Networks and network services are monitored	Active exploitation risk makes monitoring exposed appliance services material.
Recommendation — Inventory affected appliances and record exposure to this CVE. Restrict and maintain appliance configuration to remove reachable vulnerable paths. Monitor exposed appliance services for exploitation indicators and abnormal requests.

Practitioner Guidance

What to verify: Confirm whether any EX or SRX instance is exposed to untrusted networks, whether the vulnerable service is reachable, and whether the device has been patched or otherwise taken out of the exposed condition. If you cannot answer those three points quickly, treat the asset as high priority.

What to prioritise: Review the devices that sit closest to the internet, then the ones with administrative reach into sensitive segments, then any appliance that has not been recently inventoried or logged with enough fidelity to support forensic review. That order usually matches real blast radius better than a simple scan-based severity rank.

Practitioner takeaway: For KEV-listed appliance flaws, reachability matters more than theoretical severity, and the right decision is usually to remove exposure first, then patch, then hunt for compromise if the device was reachable for any meaningful period.