Juniper fixes two critical root flaws in Session Smart Router

Juniper fixes two critical root flaws in Session Smart Router

2 November 2026: Juniper Networks has fixed two critical flaws in its Session Smart Router and Session Smart Conductor software, CVE-2026-103406 and CVE-2026-103409, both rated 9.8 on CVSS 3.1 and both exploitable by an attacker who has no login. The fixed releases are 7.0.5, 7.1.7 and 7.2.3, and Juniper says no workaround exists for either. Its security team is "not aware of any malicious exploitation".

Not yet independently verified. Juniper's support portal bulletin JSA112183 did not load for us, so the total of 18 flaws in the bulletin and the ids of the lower-rated ones come from ThaiCERT and the Canadian Centre for Cyber Security rather than from Juniper. We will update this when it can be confirmed, and remove this note.

The two flaws sit in on-demand bulletin JSA112183, published on 28 October, which Thailand's and Canada's national CERTs say covers 18 vulnerabilities in all: two critical, eight high, seven medium and one low.

Root commands through a salt minion ID

CVE-2026-103406 affects Session Smart Conductor, the central management system for a Session Smart deployment. Juniper describes an OS command injection in the AutomatedProvisioner component that lets a remote attacker "execute arbitrary commands as root via a specially crafted salt minion ID". Salt is the configuration management system the conductor uses to provision routers, so the attack reaches the box that controls every router in the estate.

Admin rights on routers before onboarding

CVE-2026-103409 affects the router itself. An endpoint running as root accepts crafted URL parameters without authentication and hands the caller administrative privileges. Juniper narrows the exposure in its record: the flaw "can only be exploited prior to the device being onboarded to Mist/Conductor", and it stops working once the router is onboarded.

That makes the risk concentrated in two places: routers shipped to branches and waiting to be brought under management, and routers that were deployed without onboarding at all. A router sitting on a public link in that state is the case to find first.

Which releases carry the fix

The same version lines are affected and fixed for both products:

• before 7.0.5: fixed in 7.0.5 and later;
• 7.1.0 up to 7.1.7: fixed in 7.1.7 and later;
• 7.2.0 up to 7.2.3: fixed in 7.2.3 and later.

Upgrade the conductor first, since it is the system that can reach every managed router. Until then, the national CERTs advise limiting access to the management interfaces to trusted networks, which reduces exposure but does not remove the flaws.

The bulletin's eight high-rated flaws, among them CVE-2026-103401, CVE-2026-103402, CVE-2026-103403, CVE-2026-103407 and CVE-2026-103408, are fixed in the same releases, so one upgrade covers the set. Neither critical flaw was on CISA's Known Exploited Vulnerabilities catalogue when we checked on 2 November. This bulletin is separate from the Junos OS Evolved fixes Juniper published earlier in October, which cover a different product line.

Related on TrustList:

• HPE fixes maximum-severity flaws in Aruba AOS-10 and AOS-8 wireless
• Juniper fixes nine critical Junos flaws, several giving root code execution
• Hijacked .gh, .sl and .as domains used to get fake Google certificates

Sources

• Juniper Networks: CVE-2026-103406 record (CNA), 28 October 2026
• Juniper Networks: CVE-2026-103409 record (CNA), 28 October 2026
• Juniper Networks: JSA112183, 2026-10 On-Demand Security Bulletin, Session Smart Router and Session Smart Conductor, 28 October 2026
• Canadian Centre for Cyber Security: Juniper Networks security advisory (AV26-1101), 28 October 2026
• ThaiCERT: Juniper Session Smart Router and Conductor vulnerabilities, 2 November 2026