What’s Vulnerable › Products
Juniper Networks Session Smart Router vulnerabilities
18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.
Check whether your Juniper Networks Session Smart Router version is affected
Latest Juniper Networks Session Smart Router vulnerabilities
- CVE-2026-106079 — Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration (CVSS 8.8)
- CVE-2026-103411 — Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing (CVSS 7.1)
- CVE-2026-103410 — Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection (CVSS 7.5)
- CVE-2026-103409 — Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed (CVSS 9.8)
- CVE-2026-103408 — Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options (CVSS 8.8)
- CVE-2026-103407 — Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management (CVSS 8.8)
- CVE-2026-103405 — Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting (CVSS 5.8)
- CVE-2026-103403 — Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules (CVSS 8.8)
- CVE-2026-103402 — Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation (CVSS 8.8)
- CVE-2026-103401 — Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root (CVSS 8.8)
- CVE-2026-103400 — Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanup (CVSS 5.5)
- CVE-2026-103394 — Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates. (CVSS 3.7)
- CVE-2026-103393 — Session Smart Router: An attacker can cause an out-of-bounds read during VRRP packet processing (CVSS 4.3)
- CVE-2026-103392 — Session Smart Router: A SACK option causes out-of-bounds memory access and TCP payload corruption when TCP sequence stitching is enabled (CVSS 4.8)
- CVE-2026-103391 — Session Smart Router: An attacker-controlled TCP option causes an out-of-bounds write when using the TCP proxy feature (CVSS 5.3)
- CVE-2026-103390 — Session Smart Router and Session Smart Conductor: A malformed HTTP URI causes a service crash during HTTP application identification (CVSS 5.3)
- CVE-2025-21589 — Session Smart Router, Session Smart Conductor, WAN Assurance Router: API Authentication Bypass vulnerability (CVSS 9.8)
- CVE-2024-2973 — Session Smart Router(SSR): On redundant router deployments API authentication can be bypassed (CVSS 10.0)