# Juniper Session Smart Router and Conductor: two CVSS 9.8 flaws give unauthenticated root (CVE-2026-103409, CVE-2026-103406) · pwn.watch > Juniper published an out-of-cycle bulletin (JSA112183) on Oct 28 fixing multiple internally found vulnerabilities in Session Smart Router (SSR) and Session Smart Conductor, its SD-WAN routing platform. Two are rated CVSS 9.8: CVE-2026-103409 lets an unauthenticated network attacker get administrative privileges on a Session Smart Router by passing crafted URL parameters to an insecure endpoint that runs as root, but only before the device is onboarded to Mist or Conductor. CVE-2026-103406 is an OS command injection in Session Smart Conductor's AutomatedProvisioner that lets a remote attacker run commands as root through a crafted salt minion ID. Both affect versions before 7.0.5, 7.1.x before 7.1.7 and 7.2.x before 7.2.3, and are fixed in 7.0.5, 7.1.7 and 7.2.3. Juniper lists no workarounds and says it is not aware of malicious exploitation. Page: https://pwn.watch/i/juniper-session-smart-router-cve-2026-103409 · generated 2026-10-28T20:12:14.572Z ## Status - Severity: critical · status: live · patch: patched - Product: Juniper Networks Session Smart Router and Session Smart Conductor - Started: 2026-10-28 - CVEs: CVE-2026-103409, CVE-2026-103406 - Affected: Session Smart Router before 7.0.5; Session Smart Router 7.1.0 before 7.1.7; Session Smart Router 7.2.0 before 7.2.3; Session Smart Conductor before 7.0.5; Session Smart Conductor 7.1.0 before 7.1.7; Session Smart Conductor 7.2.0 before 7.2.3 - Fixed in: 7.0.5 and later; 7.1.7 and later; 7.2.3 and later ## Follow this incident - RSS (one item per update): https://pwn.watch/i/juniper-session-smart-router-cve-2026-103409/feed.xml - JSON Feed: https://pwn.watch/i/juniper-session-smart-router-cve-2026-103409/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/juniper-session-smart-router-cve-2026-103409.json - This file: https://pwn.watch/i/juniper-session-smart-router-cve-2026-103409/llms.txt ## Updates (newest first) - 2026-10-28: Juniper publishes JSA112183, an on-demand bulletin fixing multiple internally discovered Session Smart Router and Conductor vulnerabilities, including CVE-2026-103409 (missing authentication on a root endpoint, pre-onboarding only) and CVE-2026-103406 (command injection in the Conductor's AutomatedProvisioner), both CVSS 9.8. Fixed in 7.0.5, 7.1.7 and 7.2.3. (https://supportportal.juniper.net/JSA112183) ## Fix brief # Security brief: Juniper Session Smart Router and Conductor: two CVSS 9.8 flaws give unauthenticated root (CVE-2026-103409, CVE-2026-103406) Source: https://pwn.watch/i/juniper-session-smart-router-cve-2026-103409 · status: live · severity: critical · updated Oct 28, 2026, 16:57 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Juniper published an out-of-cycle bulletin (JSA112183) on Oct 28 fixing multiple internally found vulnerabilities in Session Smart Router (SSR) and Session Smart Conductor, its SD-WAN routing platform. Two are rated CVSS 9.8: CVE-2026-103409 lets an unauthenticated network attacker get administrative privileges on a Session Smart Router by passing crafted URL parameters to an insecure endpoint that runs as root, but only before the device is onboarded to Mist or Conductor. CVE-2026-103406 is an OS command injection in Session Smart Conductor's AutomatedProvisioner that lets a remote attacker run commands as root through a crafted salt minion ID. Both affect versions before 7.0.5, 7.1.x before 7.1.7 and 7.2.x before 7.2.3, and are fixed in 7.0.5, 7.1.7 and 7.2.3. Juniper lists no workarounds and says it is not aware of malicious exploitation. Severity detail: CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N) for both CVEs; no workarounds; Juniper SIRT not aware of malicious exploitation - Product: Juniper Networks Session Smart Router and Session Smart Conductor - CVE / advisory ids: CVE-2026-103409, CVE-2026-103406 ## Affected versions - Session Smart Router before 7.0.5 - Session Smart Router 7.1.0 before 7.1.7 - Session Smart Router 7.2.0 before 7.2.3 - Session Smart Conductor before 7.0.5 - Session Smart Conductor 7.1.0 before 7.1.7 - Session Smart Conductor 7.2.0 before 7.2.3 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - 7.0.5 and later - 7.1.7 and later - 7.2.3 and later After upgrading, re-run the checks above and redeploy/restart the affected services. ## Specific notes Check the Session Smart Router or Conductor version. If it is below 7.0.5, 7.1.x below 7.1.7 or 7.2.x below 7.2.3, upgrade to 7.0.5, 7.1.7 or 7.2.3 or later. Juniper lists no workarounds. CVE-2026-103409 only applies to routers not yet onboarded to Mist or Conductor, so onboard new devices before exposing them, and keep Conductor management interfaces off untrusted networks until upgraded. ## Latest updates - Oct 28, 2026: Juniper publishes JSA112183, an on-demand bulletin fixing multiple internally discovered Session Smart Router and Conductor vulnerabilities, including CVE-2026-103409 (missing authentication on a root endpoint, pre-onboarding only) and CVE-2026-103406 (command injection in the Conductor's AutomatedProvisioner), both CVSS 9.8. Fixed in 7.0.5, 7.1.7 and 7.2.3. ## Advisories - [JSA112183: Session Smart Router and Session Smart Conductor: Multiple internally discovered vulnerabilities resolved](https://supportportal.juniper.net/JSA112183) (Juniper Networks) - [CVE-2026-103409: Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed](https://www.cve.org/CVERecord?id=CVE-2026-103409) (CVE.org) - [CVE-2026-103406: Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management](https://www.cve.org/CVERecord?id=CVE-2026-103406) (CVE.org) ## Caveats Primary sources are Juniper's CVE records for both CVEs, which reference JSA112183. The bulletin covers more Session Smart CVEs than the two tracked here; only the two CVSS 9.8 issues are listed. Juniper says both were found internally (defects I95-65016 and I95-65205). --- Machine-readable: https://pwn.watch/i/juniper-session-smart-router-cve-2026-103409.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.