CVE-2025-21590: Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 13 Mar 2025, 1 day after the CVE record was published.

How likely is exploitation in the next 30 days?

1.7%

EPSS score, percentile 77.6 of all scored records

How severe?

6.7 Medium

CVSS v4.0 base score, given by the CNA

What should I do?

CISA deadline 3 Apr 2025. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Advisories and patches (1)

Which versions are affected?

Affected

• before 21.2R3-S9
• from 21.4 to before 21.4R3-S10
• from 22.2 to before 22.2R3-S6
• from 22.4 to before 22.4R3-S6
• from 23.2 to before 23.2R2-S3
• from 23.4 to before 23.4R2-S4

and 1 more in the table below

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

What to do

CISA due date for this action: 3 April 2025.

Solution (from the CVE record)

The following software releases have been updated to resolve this specific issue: 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3-S6, 23.2R2-S3, 23.4R2-S4, 24.2R1-S2, 24.2R2, 24.4R1, and all subsequent releases.   Please note that this issue is not fixed for all platforms in the releases specified in the solution section. For the following products the fix is only available in these releases: SRX300 Series   21.2R3-S9, 23.4R2-S5*, 24.4R1 SRX550HM    22.2R3-S7* EX4300 Series     21.4R3-S11* (except EX4300-48MP which has fixes available as indicated in the solution) EX4600               21.4R3-S11* (except EX4650 which has fixes available as indicated in the solution) ACX1000, ACX1100, ACX2100, ACX2200, ACX4000, ACX500              21.2R3-S9 MX104               21.2R3-S9 * Future Release

Workaround (from the CVE record)

It is strongly recommended to mitigate the risk of exploitation by restricting shell access to trusted users only.

Advisories and patches

• supportportal.juniper.net (Vendor advisory)

Linked from CISA's catalog entry

• https://supportportal.juniper.net/s/article/2025-03-Out-of-Cycle-Security-Bulletin-Junos-OS-A-local-attacker-with-shell-access-can-execute-arbitrary-code-CVE-2025-21590?language=en_US
• https://nvd.nist.gov/vuln/detail/CVE-2025-21590

Affected products and versions

As listed in the CVE record.

Versions not listed are: unaffected.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

About this vulnerability

Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.

Summary: CISA's KEV catalog, as of 28 Oct 2026.

• CISA added CVE-2025-21590 to its Known Exploited Vulnerabilities (KEV) catalog on 13 Mar 2025.
• CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
• The due date CISA sets for the required action is 3 Apr 2025.
• The CVE record was published on 12 Mar 2025, 1 day before it was added to KEV.
• The CVE record carries a CVSS v4.0 base score of 6.7 (Medium), given by its CNA.
• FIRST's EPSS model puts the probability of exploitation in the next 30 days at 1.7% (percentile 77.6), as of 28 Oct 2026.
• CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.

Description

Junos OS: An local attacker with shell access can execute arbitrary code

An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device. A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device. This issue is not exploitable from the Junos CLI. This issue affects Junos OS:  * All versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S10,  * 22.2 versions before 22.2R3-S6,  * 22.4 versions before 22.4R3-S6,  * 23.2 versions before 23.2R2-S3,  * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R1-S2, 24.2R2.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

Weakness

• CWE-653: Improper Isolation or Compartmentalization

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.

Timeline

References

• cloud.google.com (Third-party advisory)

More exploited Juniper vulnerabilities

• CVE-2015-7755: Juniper ScreenOS Improper Authentication Vulnerability (added 2 Oct 2025)
• CVE-2023-36844: Juniper Junos OS EX Series PHP External Variable Modification Vulnerability (added 13 Nov 2023)
• CVE-2023-36845: Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability (added 13 Nov 2023)
• CVE-2023-36846: Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability (added 13 Nov 2023)
• CVE-2023-36847: Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability (added 13 Nov 2023)
• CVE-2023-36851: Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability (added 13 Nov 2023)