Actively exploited in the wild
Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability
Juniper - Junos OS · Listed in the CISA KEV since 2023-11-13. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-36845
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
CVE-2023-36845 is a PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS that allows an unauthenticated, network-based attacker to remotely execute code by modifying the PHPRC variable. This enables code injection and execution in the PHP execution environment.
Risk Assessment
This vulnerability poses a significant risk to organizations as it allows for remote code execution, potentially leading to system takeover. An attacker could exploit this flaw to deploy malware or steal data.
Recommendation
It is recommended to update Junos OS to a version that is not vulnerable to this issue, specifically to version 20.4R3-S9 or later. Additionally, network traffic should be monitored for potential attack attempts.
Related vulnerabilities
- CVE-2026-44267Critical
Elo prior to 1.0.1 allows plain strings passed to the parser to use the .constructor.constructor property to reach the JavaScript Function object. The resulting generated JavaScript executes attacker-selected code in the host runtime, enabling browser script execution and arbitrary Node.js code execution.
- CVE-2026-44266Critical
Elo prior to 1.0.1 has a Ruby backend that embeds attacker-controlled text in double-quoted Ruby strings without escaping #. Ruby interpolation forms in the string-literal emitter or labelled subtype-constraint branch become executable Ruby, allowing Ruby code and shell command execution.
- CVE-2026-28336Critical
SolarWinds Dameware is affected by a command injection vulnerability that could lead to compromise of the remotely controlled host. Authentication is required.
- CVE-2026-109593Critical
An unauthenticated attacker with network access to SonicWall GMS 9.5.2 and earlier may be able to read internal GMS files, potentially exposing sensitive information.
- CVE-2026-121260Critical
Ziroom ZHOME A0101 1.0.1.0 Build 202004151405 contains a flaw in the loadstring function of usr/lib/lua/luci/controller/api/zrUsb.lua (Lua Handler component). The manipulation causes code injection and can be exploited remotely. The exploit has been published and may be used; the vendor did not respond to the disclosure.
- CVE-2026-118527MediumActively exploited
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
- CVE-2026-89292Critical
In Eclipse Mnestix Browser versions 1.6.0 up to but excluding 2.3.0, an unauthenticated attacker could exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.
- CVE-2026-4052Critical
This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.
- CVE-2026-13594Critical
Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.
- CVE-2026-120534Critical
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. Insufficient validation of form configuration parameters allows unauthenticated attackers to call arbitrary WordPress functions with controlled arguments.
Original NVD description (English source)
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code. This issue affects Juniper Networks Junos OS on EX Series and SRX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R2-S2, 22.3R3-S1; * 22.4 versions prior to 22.4R2-S1, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS