CVE-2025-11198

highpriority · track · 0OT risk · elevatedEPSS 0.003 · 19 %ileDEEUNLUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.27% (19th) EPSS
CVSS 7.4 · high
Is it mine?
13 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · cert_bund · ncsc_nl

EPSS · scored 2026-10-27

A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based attacker to replace legitimate vSRX images with malicious ones. If a trusted user initiates deployment, Security Director Policy Enforcer will deliver the attacker's uploaded image to VMware NSX instead of a legitimate one. This issue affects Security Director Policy Enforcer:   * All versions before 23.1R1 Hotpatch v3. This issue does not affect Junos Space Security Director Insights.

01

cvss

Technical severity, 0–10. One row per scoring source.

8.5
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.8–8.5

v3.17.4highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:Nsecondary · sirt@juniper.net USexploitability 2.8 · impact 4
v3.17.4highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:Nsecondary · NCSC-NL NL
v4.08.5highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/AU:Y/R:U/V:C/RE:M/U:Redsecondary · ENISA EU
v4.08.5highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Redsecondary · sirt@juniper.net US
v4.05.8mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Redsecondary · CVSS-BT (t0sche)
02

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-306USCWE-306US
04

affected products (13)

Products and version ranges known to be affected.

05

advisories (2)

Vendor and ecosystem advisories describing this.

  • NCSC-2025-0305Kwetsbaarheden verholpen in Juniper Networks Junos OSNL2025-10-13csaf · ncsc_nlNL

    Juniper heeft kwetsbaarheden verholpen in Junos OS (Specifiek voor EX4600, QFX5000 Series switches en SRX4700 apparaten).

  • WID-SEC-W-2025-2238Juniper JUNOS OS, Space, OS Evolved: Mehrere SchwachstellenDeutsch2025-10-08csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS ausnutzen, um sich erweiterte Berechtigungen zu verschaffen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcert_bundncsc_nlnvdNVDCVE.orgMITRE
published 2025-10-09modified 2026-06-17
08

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan