Yes. CISA added CVE-2023-36846 to its Known Exploited Vulnerabilities catalogue on 13 November 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
What “in the wild” means for CVE-2023-36846
For this CVE, “in the wild” is not a theoretical label, it means CISA judged the issue to have reliable evidence of active exploitation and placed it in the CISA Known Exploited Vulnerabilities Catalog. That matters because KEV inclusion is a practical exploitation signal, not a generic severity score. If you operate edge devices, exposure should be treated as an active incident-response priority rather than a routine patch item.
The question is not whether Juniper Junos OS SRX Series has a flaw, but whether defenders should assume attackers are already using it. For that reason, the right operational stance is to verify inventory, confirm whether SRX appliances are reachable from untrusted networks, and treat any delayed remediation as a temporary exception that needs compensating controls and follow-up validation.
What the vulnerability changes operationally
This issue is a CVE on network-facing security appliance software, so the main operational concern is not just service interruption but trust boundary erosion. A missing authentication for a critical function means an unauthenticated remote actor can reach functionality that should have required proof of identity or administrative context. On edge platforms, that usually shifts the response from ordinary hardening to urgent exposure reduction and integrity checks.
Because Juniper identifies the flaw as affecting SRX Series devices and the direct answer says the impact is limited to file system integrity, practitioners should focus on what can be modified, where configuration and system files reside, and whether the appliance was exposed long enough for an attacker to stage follow-on activity. The relevant comparison is not “can the device still route traffic,” but “can an attacker alter appliance state, persistence material, or adjacent management trust without authenticating.”
The most useful source of product and remediation detail remains the vendor advisory, together with the KEV entry and the NIST National Vulnerability Database record for the canonical CVE description and reference trail.
How to assess exposure and respond safely
Start with asset confirmation: identify every Junos OS SRX device, every management path, and every instance where the appliance is reachable from the internet or from broad internal networks. Then determine whether any compensating controls already reduce exposure, such as strict management-plane segmentation, restricted admin access, and monitoring for unexpected changes to system or configuration files. The goal is to establish whether the device could have been reached by an unauthenticated network actor, not just whether it is presently patched.
If patching or upgrading must wait, prioritize exposure reduction over cosmetic mitigation. Restrict management access, isolate the appliance from untrusted paths, monitor logs and file integrity, and preserve evidence before making disruptive changes if you suspect compromise. The question of whether to rotate credentials is secondary here, but it becomes relevant if the appliance stores secrets, admin access material, or configuration data that may have been exposed during an intrusion path.
For prioritisation, use the KEV entry and vulnerability management workflow together. CISA has already signalled that this class of issue has crossed the active exploitation threshold, so the decision is no longer “should we fix eventually,” but “how quickly can we remove exposure or prove compensating control coverage.”
Risk and Threat Considerations
Internet-facing network appliances are attractive to attackers because they sit at the boundary between users, management services, and internal traffic. A missing-authentication flaw on that type of device can be used for opportunistic exploitation, broad scanning, and post-compromise staging, especially where administrators assume the management plane is less likely to be targeted than application servers.
Failure mechanism: An unauthenticated network actor reaches a critical function that should have required access control, then uses that path to alter appliance state or system files, potentially creating persistence, destabilizing the device, or preparing the environment for further compromise.
Impact: The direct impact may be limited to file system integrity, but in practice that can still mean configuration tampering, loss of trust in the appliance, service disruption, and a need to treat the device as potentially compromised until verified clean.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | Active exploitation requires risk-based prioritization and exception handling for exposed SRX devices. |
| DE.CM-01 — Network Monitorings | Active exploitation of an edge device warrants monitoring for suspicious network and file changes. | |
| Recommendation — Prioritize exposed SRX appliances for urgent remediation or compensating controls. Monitor SRX management and file integrity for signs of compromise. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The issue is an actively exploited vulnerability that needs disciplined remediation handling. |
| IA-2 — Identification and Authentication (Organizational Users) | The flaw is a missing-authentication condition on a critical network function. | |
| Recommendation — Remediate the SRX vulnerability as quickly as operationally possible. Enforce authentication on critical administrative functions. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed exploitation calls for prioritized vulnerability tracking and remediation. |
| Recommendation — Track KEV-listed appliances and accelerate patching or mitigation. | ||
Practitioner Guidance
What to verify: Confirm whether any SRX device is exposed to untrusted networks, whether the affected function is reachable, and whether file integrity or configuration drift has occurred since the last known-good state. If you cannot answer those three questions quickly, you should assume the appliance needs urgent review.
What to prioritise: Remediation order should follow exposure, not asset convenience. Publicly reachable appliances and devices supporting sensitive management or transit paths deserve first attention, because those are the systems most likely to be probed immediately after KEV listing.
Practitioner takeaway: KEV inclusion means you should treat this as active exploitation risk, not a theoretical Juniper issue, and verify exposure, integrity, and remediation status before you rely on the device for normal trust decisions.
Related resources from NHI Mgmt Group
- Is CVE-2023-36847 (Juniper Junos OS EX Series Missing Authentication for Critical Function) being exploited in the wild?
- How do you patch or mitigate CVE-2023-36846 (Juniper Junos OS SRX Series Missing Authentication for Critical Function)?
- CVE-2023-36846 (Juniper Junos OS SRX Series Missing Authentication for Critical Function)
- How do you patch or mitigate CVE-2023-36851 (Juniper Junos OS SRX Series Missing Authentication for Critical Function)?