Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

Juniper Session Smart Router and Conductor: two CVSS 9.8 flaws give unauthenticated root (CVE-2026-103409, CVE-2026-103406)

Juniper Networks Session Smart Router and Session Smart Conductor

Juniper published an out-of-cycle bulletin (JSA112183) on Oct 28 fixing multiple internally found vulnerabilities in Session Smart Router (SSR) and Session Smart Conductor, its SD-WAN routing platform. Two are rated CVSS 9.8: CVE-2026-103409 lets an unauthenticated network attacker get administrative privileges on a Session Smart Router by passing crafted URL parameters to an insecure endpoint that runs as root, but only before the device is onboarded to Mist or Conductor. CVE-2026-103406 is an OS command injection in Session Smart Conductor's AutomatedProvisioner that lets a remote attacker run commands as root through a crafted salt minion ID. Both affect versions before 7.0.5, 7.1.x before 7.1.7 and 7.2.x before 7.2.3, and are fixed in 7.0.5, 7.1.7 and 7.2.3. Juniper lists no workarounds and says it is not aware of malicious exploitation.

Why this severity: CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N) for both CVEs; no workarounds; Juniper SIRT not aware of malicious exploitation

Started
Oct 28, 2026
CVEs
CVE-2026-103409CVE-2026-103406

Follow this incident

Discuss on X ↗

Affected

  • Session Smart Router before 7.0.5
  • Session Smart Router 7.1.0 before 7.1.7
  • Session Smart Router 7.2.0 before 7.2.3
  • Session Smart Conductor before 7.0.5
  • Session Smart Conductor 7.1.0 before 7.1.7
  • Session Smart Conductor 7.2.0 before 7.2.3

Fixed in

  • 7.0.5 and later
  • 7.1.7 and later
  • 7.2.3 and later

Timeline1

  1. Juniper publishes JSA112183, an on-demand bulletin fixing multiple internally discovered Session Smart Router and Conductor vulnerabilities, including CVE-2026-103409 (missing authentication on a root endpoint, pre-onboarding only) and CVE-2026-103406 (command injection in the Conductor's AutomatedProvisioner), both CVSS 9.8. Fixed in 7.0.5, 7.1.7 and 7.2.3.

Advisories3

Posts1
Juniper SIRT
@JuniperSIRT

2026-10 On-Demand Security Bulletin: Session Smart Router and Session Smart Conductor: Multiple internally discovered vulnerabilities resolved. Refer to t.co/cz2dXql95C for more information

Notes & caveats

Primary sources are Juniper's CVE records for both CVEs, which reference JSA112183. The bulletin covers more Session Smart CVEs than the two tracked here; only the two CVSS 9.8 issues are listed. Juniper says both were found internally (defects I95-65016 and I95-65205).

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo