Juniper Session Smart Router and Conductor: two CVSS 9.8 flaws give unauthenticated root (CVE-2026-103409, CVE-2026-103406) ยท updates https://pwn.watch/i/juniper-session-smart-router-cve-2026-103409 Juniper published an out-of-cycle bulletin (JSA112183) on Oct 28 fixing multiple internally found vulnerabilities in Session Smart Router (SSR) and Session Smart Conductor, its SD-WAN routing platform. Two are rated CVSS 9.8: CVE-2026-103409 lets an unauthenticated network attacker get administrative privileges on a Session Smart Router by passing crafted URL parameters to an insecure endpoint that runs as root, but only before the device is onboarded to Mist or Conductor. CVE-2026-103406 is an OS command injection in Session Smart Conductor's AutomatedProvisioner that lets a remote attacker run commands as root through a crafted salt minion ID. Both affect versions before 7.0.5, 7.1.x before 7.1.7 and 7.2.x before 7.2.3, and are fixed in 7.0.5, 7.1.7 and 7.2.3. Juniper lists no workarounds and says it is not aware of malicious exploitation. en Wed, 28 Oct 2026 00:00:00 GMT Juniper Session Smart Router and Conductor: two CVSS 9.8 flaws give unauthenticated root (CVE-2026-103409, CVE-2026-103406): Juniper publishes JSA112183, an on-demand bulletin fixing multiple internally discovered Session Smart Router and Conductor vulnerabilities, including CVE-2026-103409 (missing authentication on a root endpoint, pre-onboarding only) and CVE-2026-103406 (command injection in the Conductor's AutomatedProvisioner), both CVSS 9.8. Fixed in 7.0.5, 7.1.7 and 7.2.3. https://pwn.watch/i/juniper-session-smart-router-cve-2026-103409 https://pwn.watch/i/juniper-session-smart-router-cve-2026-103409#2026-10-28-554bf27c Wed, 28 Oct 2026 00:00:00 GMT critical <p><a href="https://supportportal.juniper.net/JSA112183">Source</a></p>