Do Son 
TL;DR
Juniper Networks has patched 18 Session Smart Router vulnerabilities in its October 28 security bulletin, JSA112183. Two critical flaws score 9.8 on CVSS v3.1 and need no login. The bugs also affect Session Smart Conductor, the management platform for these routers.
Unauthenticated attackers could run commands on the Conductor or gain admin rights on the router. Juniper’s own testing found all 18 issues. Upgrade to 7.0.5, 7.1.7 or 7.2.3 now.
Why It Matters
Session Smart Router powers Juniper’s SD-WAN deployments, while Conductor manages the whole router fleet. As a result, a compromised Conductor could put many sites at risk. Juniper rates the bulletin “Critical” and says the issues “affect all versions” of both products.
How the Attack Works
Critical flaws
CVE-2026-103406 hits Session Smart Conductor. According to Juniper, “an unauthenticated attacker causes arbitrary command execution during key management.” Meanwhile, CVE-2026-103409 affects the router. There, “an attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed.”
High severity flaws
Six more bugs score 8.8. Most need a low-privileged account, yet they can lead to root file overwrites, code execution or privilege escalation. For example, one flaw stems from a “lack of integrity verification in cache files.” Another, CVE-2026-103408, enables remote code execution through crafted DHCP options from an adjacent network.
The remaining Session Smart Router vulnerabilities range from 3.7 to 7.5. They cover crashes, memory errors and HTTP response splitting.
Affected Versions
According to the Juniper security bulletin, all Session Smart Router and Session Smart Conductor versions before 7.0.5, 7.1.7 and 7.2.3 are affected.
Patch and Mitigation
Install 7.0.5, 7.1.7, 7.2.3 or any later release. Juniper notes, “There are no known workarounds for all of these issues.” Until you patch these Session Smart Router vulnerabilities, limit access to Conductor and router management interfaces.
Juniper SIRT “is not aware of any malicious exploitation of these vulnerabilities.”
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
