Vulnerability · Published Oct 9, 2025 · Assigned by juniper

CVE-2025-11198Security Director Policy Enforcer: An unrestricted API allows a network-based unauthenticated attacker to deploy malicious vSRX images to VMWare NSX Server

High 7.4

In plain English

A high-severity missing authentication in Security Director Policy Enforcer from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.3%top 80.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based attacker to replace legitimate vSRX images with malicious ones. If a trusted user initiates deployment, Security Director Policy Enforcer will deliver the attacker's uploaded image to VMware NSX instead of a legitimate one. This issue affects Security Director Policy Enforcer: * All versions before 23.1R1 Hotpatch v3. This issue does not affect Junos Space Security Director Insights.

Affected products (as reported)

Vendor	Product	Versions
Juniper Networks	Security Director Policy Enforcer	0 – before 23.1R1 Hotpatch v3

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

References

https://supportportal.juniper.net/JSA103437 vendor-advisory