Article
Juniper Session Smart Router Vulnerability: 18 CVEs, Two Rated 9.8
The Juniper Session Smart Router vulnerability bulletin lists 18 CVEs, two rated 9.8. See which hit the Router or Conductor and which versions fix…
Read more
Vulnerability
Juniper Session Smart Router Missing Authentication (CVE-2026-103409)
A missing-authentication flaw in Juniper Networks Session Smart Router (SSR).
- CVE ID
- CVE-2026-103409
- CVSS
- 9.8 Critical (CVSS v3.1, Juniper)
- Affected product
- Juniper Networks Session Smart Router (SSR)
- Exploited
- Unknown
- Published
- 28 October 2026
In short
CVE-2026-103409 is a missing-authentication flaw in Juniper Networks Session Smart Router (SSR). Juniper says an unauthenticated attacker on the network can gain administrative privileges by passing crafted URL parameters to an insecure endpoint that runs as root. This works only before the device is onboarded to Mist/Conductor. The flaw scores CVSS 9.8 and was fixed in SSR 7.0.5, 7.1.7 and 7.2.3 in Juniper bulletin JSA112183 of 28 October 2026.
- CVECVE-2026-103409
- ProductJuniper Networks Juniper Networks Session Smart Router (SSR)
- Fix Steps5actions listedUpgrade to a fixed release · Plan for end-of-life releases
What it allows
Juniper's CVE record describes a missing authentication for a critical function in Session Smart Router. An unauthenticated attacker on the network can obtain administrative privileges by passing crafted URL parameters to an insecure endpoint that runs as root. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The record adds a limit. The flaw can only be exploited before the device is onboarded to Mist/Conductor, and the issue can no longer be exploited once a device is onboarded. Neither the bulletin nor the record says how exposed such a device is.
Juniper SIRT states that it is not aware of malicious exploitation. CISA's Known Exploited Vulnerabilities catalog, version 2026.10.27, does not list the CVE (checked 28 October 2026). Our news post on the Juniper bulletin compares all 18 CVEs.
The same bulletin fixes a second CVSS 9.8 flaw, in Session Smart Conductor. It is described on our CVE-2026-103406 page.
Who is affected
Juniper's bulletin says all versions of Session Smart Router before 7.0.5, 7.1.7 and 7.2.3 are affected. The CVE record gives the ranges as every version below 7.0.5, 7.1.0 up to but not including 7.1.7, and 7.2.0 up to but not including 7.2.3. It lists no Session Smart Conductor version for this flaw.
Per the CVE record, only devices that are not yet onboarded to Mist/Conductor can be exploited through it. Juniper fixed the flaw in 7.0.5, 7.1.7 and 7.2.3 and all subsequent releases.
Juniper SIRT's policy is not to evaluate releases beyond End of Engineering (EOE) or End of Life (EOL).
Timeline
- 30 Sep 2026
Juniper, as the CVE assigner, reserves the CVE id.
- 28 Oct 2026
Juniper publishes bulletin JSA112183 with fixes in 7.0.5, 7.1.7 and 7.2.3. The CVE and NVD records are published the same day. Juniper SIRT says it is not aware of malicious exploitation.
What to do
-
Find your Session Smart Routers
List every Session Smart Router with its version. Versions before 7.0.5, 7.1.7 or 7.2.3 on their release line are affected.
-
Upgrade to a fixed release
Install 7.0.5, 7.1.7 or 7.2.3, or a later release. Juniper says there are no known workarounds for this issue.
-
Treat routers not yet onboarded first
The flaw can only be exploited before a device is onboarded to Mist/Conductor, so devices still waiting for onboarding carry the risk. This is our reading of the CVE record, not Juniper's advice.
-
Plan for end-of-life releases
Juniper SIRT does not evaluate releases beyond End of Engineering or End of Life. If a router runs one, plan the move to a supported release.
-
Watch for changes
Check the Juniper bulletin, the NVD record and the CISA catalog again over the coming days. Juniper's statement on exploitation can change.
Questions
What is CVE-2026-103409?
It is a missing-authentication flaw in Juniper Session Smart Router. Juniper says an unauthenticated attacker on the network can obtain administrative privileges through an insecure endpoint that runs as root. It scores CVSS 9.8.
Which versions are affected and which fix it?
Juniper says all versions of Session Smart Router before 7.0.5, 7.1.7 and 7.2.3 are affected. Releases 7.0.5, 7.1.7, 7.2.3 and all subsequent ones fix it.
Is CVE-2026-103409 exploited?
Juniper SIRT says it is not aware of malicious exploitation. CISA's catalog version 2026.10.27 does not list the CVE (checked 28 October 2026).
Is there a workaround for CVE-2026-103409?
Juniper's CVE record says there are no known workarounds for this issue. The fix is the upgrade.
Does CVE-2026-103409 affect Session Smart Conductor?
Not according to the CVE record, which lists only Session Smart Router. The same bulletin fixes CVE-2026-103406 in the Conductor.
In our research
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 52 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 59 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 92 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.