DaystoPatch

Juniper NetworksExploited incident

Junos OS kernel isolation flaw used by UNC3886 to implant backdoors on Juniper routers

CVE-2025-21590Medium, CVSS 6.7In CISA's Known Exploited Vulnerabilities catalog since 13 Mar 2025

  • Exploited before a fix
Partly fixedExploited. Not yet fixed for every supported version.

Open for

Counting from the first public report, 11 Mar 2025. Juniper Networks's first statement came 1 day later. A first fix shipped 1 day later. Not every supported version has one yet.

Embed this live clock

Response

Silence
1d
First public report to first vendor statement
Exposure
1d
First public report to first fix
Follow-through
ongoing
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Open, no fix
  • Open, partly fixed
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Mandiant / Google Threat Intelligence: Ghost in the RouterCuratedQuote verified

    This specific technique is now tracked as CVE-2025-21590, as detailed in Juniper Network’s security bulletin JSA93446.

    Post dated March 11, 2025, describing UNC3886 backdoors on Juniper MX routers found in mid-2024. The sentence referencing the CVE may have been added after first publication.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7b794555648bd58b…
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    CVE.org record CVE-2025-21590ClaimedQuote verified12 Mar 2025, 13:59 UTC

    An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c68dc18c4f911642…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-21590)ClaimedQuote verified13 Mar 2025

    Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability

    Added to CISA's KEV catalog on 2025-03-13.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet13 Mar 2025, 15:09 UTC

    4/4 ⚠️ Juniper Networks urges organizations to update MX routers to mitigate risks. A newly disclosed flaw, CVE-2025-21590, allows attackers to execute malware even on veriexec-protected devices. #JuniperNetworks #CyberDefense #CyberEspionage #APTUNC3886 #Infosec #CyberSecurity #APT

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet13 Mar 2025, 16:15 UTC

    Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers # UNC3886 # CVE_2025_21590 https:// cloud.google.com/blog/topics/t

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    +1d

    CVE record CVE-2025-21590 (CNA: Juniper, advisory JSA93446)CuratedQuote verified

    "datePublished":"2025-03-12T13:59:43.038Z"

    Juniper's out-of-cycle bulletin JSA93446 is on the JavaScript-only support portal; the CVE record Juniper published is used.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c68dc18c4f911642…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    +1d

    CVE record CVE-2025-21590 (workarounds field)CuratedQuote verified

    It is strongly recommended to mitigate the risk of exploitation by restricting shell access to trusted users only.

    Record last updated 2026-02-26, so the workaround text is assumed to date from the bulletin; not verified against the first version.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c68dc18c4f911642…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    +1d

    CVE record CVE-2025-21590 (solutions field)CuratedQuote verified

    The following software releases have been updated to resolve this specific issue: 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3-S6, 23.2R2-S3, 23.4R2-S4, 24.2R1-S2, 24.2R2, 24.4R1, and all subsequent releases.

    Several of these releases likely shipped before the bulletin (the fixes track internal defects 1838460 and 1872010); individual release dates were not verified, so the bulletin time is used. Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c68dc18c4f911642…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    No evidence yet of fixed releases for every supported branch.

Send this to your boss

Junos flaw used by spies to backdoor routers; some platform fixes pending

A China-nexus espionage group used a Junos OS kernel flaw to plant backdoors on Juniper routers, and Juniper's fixes for some platforms were still listed as future releases.

In plain words

A state-backed hacking group used a weakness in Juniper's router software to hide backdoors on network routers, mostly older ones. Juniper released fixes in March 2025, but for a few device models the fix was still marked as a future release in its latest update. If we run Juniper equipment, we need the fixed software, tight control over who can log into the devices, and a plan to retire end-of-life models.

What happened and who is affected

What happened

On 11 March 2025 Mandiant reported that UNC3886 had installed custom backdoors on Juniper MX routers, many running end-of-life hardware and software. Juniper published bulletin JSA93446 on 12 March 2025 for CVE-2025-21590, which lets a local attacker with shell access inject code despite Junos integrity protections. Fixed releases were listed for the main Junos trains, but for some platforms (SRX300, SRX550HM, EX4300, EX4600) the fix was marked 'Future Release' in Juniper's latest record (updated February 2026).

Who is affected

Junos OS before 21.2R3-S9, 21.4 before 21.4R3-S10, 22.2 before 22.2R3-S6, 22.4 before 22.4R3-S6, 23.2 before 23.2R2-S3, 23.4 before 23.4R2-S4, 24.2 before 24.2R1-S2/24.2R2; on SRX300, SRX550HM, EX4300 and EX4600 only specific later releases contain the fix.

CVE-2025-21590. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/juniper-cve-2025-21590/

Affected products

  • Junos OS (MX, SRX, EX, ACX and other platforms)
How we built this timeline

Status 'partial' because the CVE record (Juniper as CNA, last updated 26 Feb 2026) still marks platform-specific fixes for SRX300 (23.4R2-S5), SRX550HM (22.2R3-S7), EX4300 and EX4600 (21.4R3-S11) as '* Future Release'; these may have shipped since, which a reviewer should check on JSA93446. Fixed for all versions omitted for the same reason.

Exploitation: Mandiant found the backdoors in mid-2024; Juniper's record says 'At least one instance of malicious exploitation has been reported to the Juniper SIRT.' Requires high-privileged local shell access (CVSS 6.7 v3.1).

KEV 13 Mar 2025. Mandiant's companion post is dated 11 Mar 2025, a day before the CVE record.

T1 check (23 Oct 2026): Juniper's 'Junos OS Dates & Milestones' table gives 24.4 a first-release date of 12/29/2024 (24.4R1 is a listed fixed release), but the table is rendered by script and the release notes are JavaScript-only, so the earlier date is not quotable and First fix stays an upper bound. exploited before a fix stays true either way: Mandiant found the backdoors in mid-2024, before any listed fixed release. If 24.4R1 is accepted, First fix ≤ 29 Dec 2024 (before world), and exposure becomes 0.

Related

No related incidents.

Juniper Networks report card