How do you patch or mitigate CVE-2023-36845 (Juniper Junos OS EX Series and SRX Series PHP External Variable Modification)?

CISA’s required action for CVE-2023-36845 is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. In practice, find every instance of Juniper Junos OS in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service.

What actually changes when you patch CVE-2023-36845?

The practical answer is that you are reducing the risk created by vulnerable Junos OS edge appliances that are reachable and manageable in your environment. Treat every EX Series and SRX Series instance as an asset inventory problem first, because the fix only helps if you identify all deployed units, confirm which are exposed, and verify that the vendor update or mitigation was actually applied.

For internet-facing appliances, the security outcome is often determined less by the patch itself than by whether management access, administrative paths, and external exposure are already controlled. If a system cannot be updated immediately, the compensating step is to narrow reachability so the vulnerable service is no longer exposed to untrusted networks.

When patching is not possible, the fallback is operational containment. That can mean removing the device from service, isolating it from the internet, or replacing it with a supported alternative rather than leaving a known-exploitable appliance in place.

How should you work through the fix in an environment with many Juniper devices?

Start with a complete estate check, not a ticket-by-ticket approach. Find every Juniper Junos OS EX Series and SRX Series system, record where it sits in the network, and determine whether it is externally reachable, remotely managed, or critical to a production path. That classification tells you which devices need immediate action and which can be handled in a controlled maintenance window.

Apply the vendor’s security update or documented mitigation exactly as prescribed, then confirm the result on the device itself rather than assuming the change succeeded. For appliances that sit on sensitive paths, validate service availability after the update so the fix does not create an operational outage that leads teams to roll it back.

If the vendor mitigation is unavailable for a given deployment, use a hard decision rule: either remove the exposure or retire the product. Delaying that choice keeps the vulnerable system in the environment and leaves exploitation timing to the attacker.

For broader patch prioritisation, use the CISA Known Exploited Vulnerabilities Catalog as the trigger point and the NIST National Vulnerability Database to track the vulnerability record and product context. In parallel, NHIMG’s Vulnerability Management Guide is useful when you need a repeatable process for scoping, prioritising, verifying, and handling exceptions across a large device fleet.

What should you check if the vulnerable appliance may already have been targeted?

Because the product is an edge device, the first concern is not just patch status but whether it was reachable during the exposure window. Look for signs of unusual admin access, config changes, suspicious outbound traffic, and any unexpected modification to management or authentication settings. On appliances that sit between trust zones, small changes can have outsized impact.

If the device was exposed long enough to be a plausible target, treat the investigation as both a patching task and a compromise check. Review logs, compare the running configuration against a known-good baseline, and determine whether the appliance has been used as a pivot point into adjacent internal systems.

Where the device exposes credentials, sessions, or management access, consider rotation of any related administrative secrets after containment. That is especially important if the appliance handled privileged remote administration or was used to terminate management sessions.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	This CVE demands inventory, prioritisation, remediation, and verification of exposed appliances.
Recommendation — Prioritise and verify remediation for all exposed Junos devices in your vulnerability management process.
NIST CSF 2.0	PR.IP-12 — Vulnerability Management	The question is about patching or mitigating a known exploited vulnerability in deployed systems.
Recommendation — Track and remediate the CVE through a formal vulnerability management workflow.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Applying vendor fixes or mitigations is the core control action for this product vulnerability.
	CM-8 — System Component Inventory	You must find every Junos OS instance before remediation can be complete.
	AC-4 — Information Flow Enforcement	Removing internet exposure or constraining access is the main compensating control when patching is delayed.
Recommendation — Apply vendor-approved remediation and document the result for each affected device. Maintain an accurate inventory of Junos appliances so none are missed during remediation. Restrict reachability to the appliance until the fix or mitigation is in place.

Practitioner Guidance

What to prioritise: Patch or isolate the most exposed Junos OS systems first, especially those reachable from the internet or used for administrative access. If there is any doubt about exposure, treat the device as high priority until you can prove otherwise.

What to verify: Confirm the vendor fix or mitigation on the device, not just in a change record. Then verify that the appliance is still supported, still needed, and no longer reachable in ways that preserve the original exposure.

Decision rule: If you cannot apply the documented mitigation safely, do not leave the system in a known-vulnerable state while waiting for convenience. Remove exposure, replace the device, or take it out of service.

Practitioner takeaway: With edge appliances, the real control is not “patch somewhere later”, it is proving that the vulnerable system is either fixed, contained, or removed from a path an attacker can reach.