The Juniper Session Smart Router vulnerability bulletin of 28 October 2026, JSA112183, covers 18 CVEs in Session Smart Router (SSR) and Session Smart Conductor. Two score CVSS 9.8: CVE-2026-103409 in the Router and CVE-2026-103406 in the Conductor. Juniper fixed them all in releases 7.0.5, 7.1.7 and 7.2.3.
Juniper says its own product security testing or research found the issues. Juniper SIRT states it is not aware of any malicious exploitation. None of the 18 CVEs is in CISA’s Known Exploited Vulnerabilities catalog (version 2026.10.27, checked 28 October 2026).
Last updated: 28 October 2026. We update this page if Juniper or CISA change their notes.
Which Product Does Each Serious Flaw Hit?
The bulletin mixes flaws that hit only the Router, only the Conductor or both. The table covers the eight flaws scored 8.8 or higher, with the status each CVE record gives.
- Affected
- Not affected
Affected means the CVE record lists that product for versions before 7.0.5, 7.1.7 or 7.2.3. Not affected means the record names only the other product. A deployment that runs both products has to upgrade both.
What Do the Two 9.8 Flaws Allow?
CVE-2026-103409 is in Session Smart Router. Juniper’s CVE record calls it a missing authentication for a critical function. An unauthenticated attacker on the network can get administrative privileges by passing crafted URL parameters to an insecure endpoint that runs as root.
The record adds a limit: the flaw can only be exploited before the device is onboarded to Mist/Conductor, and no longer once it is. Neither the bulletin nor the record says how exposed such a device is. Our CVE-2026-103409 page has the details.
CVE-2026-103406 is in Session Smart Conductor. The CVE record describes an OS command injection in the AutomatedProvisioner: a remote attacker can run arbitrary commands as root through a specially crafted salt minion ID. The bulletin words it as an unauthenticated attacker causing command execution during key management.
Both CVE records say there is no workaround for these two flaws. The only fix is the upgrade. See the CVE-2026-103406 page for the details.
How Serious Are the Six 8.8 Flaws?
Six flaws score 8.8. Five of them use a vector with low privileges required, and the CVE records describe the attacker’s starting point in different ways. The sixth, CVE-2026-103408, needs no privileges but sits on the local network.
- CVE-2026-103401: A local unprivileged user can overwrite arbitrary files as root through unauthenticated API endpoints. The record says this works on Mist-managed routers and on routers not yet onboarded to a Conductor, and that routers already managed by a Conductor are not affected.
- CVE-2026-103402: An attacker with write access to the model cache directory can execute code and escalate privileges, because PCLI processes cache files that are not verified.
- CVE-2026-103403: An OS command injection in AccessManager lets an attacker delete arbitrary files and run commands when an audit rule is deleted.
- CVE-2026-103407: An authenticated REST user can read, overwrite or delete arbitrary certificate and key files through the certificate and private-key REST API of ConfigDirector.
- CVE-2026-106079: An attacker with config-write privileges can run arbitrary commands as root in the YANG configuration, again through an OS command injection in AccessManager.
- CVE-2026-103408: This one needs no privileges but a place on the local network. An unauthenticated attacker there can reach remote code execution with a malicious DHCP reply, through a stack buffer overflow in the Router’s DHCP client.
What Else Did Juniper Fix?
The other ten flaws score from 3.7 to 7.5. Juniper’s summaries are short, so here they are by score.
- CVE-2026-103410 (7.5): Router. An integer overflow causes denial of service during TLS certificate inspection.
- CVE-2026-103411 (7.1): Router, adjacent network. A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing.
- CVE-2026-103404 (6.8): Conductor. Insecure file permissions give unauthorized access to sensitive routing credentials.
- CVE-2026-103405 (5.8): Both products. Unsanitized input causes HTTP response splitting.
- CVE-2026-103400 (5.5): Both products, local. Crafted directory names cause arbitrary filesystem unmounting during service cleanup.
- CVE-2026-103390 (5.3): Both products. A malformed HTTP URI crashes the service during HTTP application identification.
- CVE-2026-103391 (5.3): Router. A TCP option causes an out-of-bounds write when the TCP proxy feature is used.
- CVE-2026-103392 (4.8): Router. A SACK option causes out-of-bounds memory access and TCP payload corruption when TCP sequence stitching is enabled.
- CVE-2026-103393 (4.3): Router, adjacent network. An attacker can cause an out-of-bounds read during VRRP packet processing.
- CVE-2026-103394 (3.7): Router. An incomplete operator causes the use of incorrect encryption keys during security policy updates.
Which Versions Fix Them?
Juniper lists three fixed releases: 7.0.5, 7.1.7 and 7.2.3, each with all subsequent releases. The bulletin says all versions of both products before those releases are affected. One upgrade per product closes all 18 CVEs.
Juniper SIRT’s policy is not to evaluate releases beyond End of Engineering (EOE) or End of Life (EOL). Juniper also says there are no known workarounds for all of these issues and points to the individual CVE records.
What Should You Do Now?
Juniper’s bulletin gives the fix and no workaround. The steps below are our own advice, not Juniper’s.
- Find every instanceList each Session Smart Router and Session Smart Conductor with its version. Anything before 7.0.5, 7.1.7 or 7.2.3 on its release line is affected.
- Upgrade to a fixed releaseInstall 7.0.5, 7.1.7 or 7.2.3, or a later release. Juniper lists no general workaround.
- Start with the two 9.8 flawsTake every Conductor first, and every Router that is not yet onboarded to Mist/Conductor, because CVE-2026-103409 can only be exploited before onboarding.
- Keep management access narrowGeneral hardening, not from Juniper: keep the management interfaces of both products off untrusted networks and review who can reach them. This does not replace the upgrade.
- Watch for changesCheck the Juniper bulletin, the NVD records and the CISA catalog again over the coming days. Juniper’s statement on exploitation can change.
For a bulletin of this size the work is a version inventory and a maintenance window, not 18 separate emergencies. Our patch management and vulnerability management definitions cover how teams plan that.