What’s Vulnerable › Vulnerabilities
CVE-2026-103409: Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-28 · updated 2026-10-28
- Weakness: CWE-306
Description
A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor.
Summary
CVE-2026-103409 is a critical missing-authentication flaw in Juniper Networks Session Smart Router that lets an unauthenticated network-based attacker gain administrative privileges by sending crafted URL parameters to an insecure endpoint running as root. The vulnerability is only exploitable before the device is onboarded to Mist/Conductor; once onboarded, it can no longer be exploited. It is not listed in CISA KEV, so no known active exploitation is reported. Affected users should upgrade to 7.0.5, 7.1.7, or 7.2.3, and onboarding devices to Mist/Conductor removes the exposure.
CVE-2026-103409 ثغرة حرجة بسبب غياب المصادقة في Juniper Networks Session Smart Router، وتسمح لمهاجم غير مصادق عبر الشبكة بالحصول على صلاحيات إدارية عبر تمرير معاملات URL مصممة إلى نقطة نهاية غير آمنة تعمل بصلاحيات root. لا يمكن استغلال الثغرة إلا قبل إلحاق الجهاز بـ Mist/Conductor، إذ يصبح الاستغلال غير ممكن بعد الإلحاق. الثغرة غير مدرجة في CISA KEV، ولا توجد معلومات عن استغلال نشط. يُنصح بالترقية إلى 7.0.5 أو 7.1.7 أو 7.2.3، وإلحاق الأجهزة بـ Mist/Conductor لإزالة التعرض.
Affected products
- Juniper Networks Session Smart Router: before 7.0.5; from 7.1.0 before 7.1.7; from 7.2.0 before 7.2.3 — fixed in 7.0.5, 7.1.7, 7.2.3
How to fix
Upgrade to a fixed version: Juniper Networks Session Smart Router 7.0.5, 7.1.7, 7.2.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-103409 or the next vulnerability affects your stack