The facts
CVE-2026-103409 allows an unauthenticated network attacker to gain administrative privileges on Session Smart Router before onboarding. Juniper says it cannot be exploited after onboarding to Mist or a Conductor. [1]
CVE-2026-103406 affects Session Smart Conductor’s provisioning component and can allow unauthenticated remote execution of commands as root during key management. [2][3]
Affected release lines are versions before 7.0.5; 7.1 versions before 7.1.7; and 7.2 versions before 7.2.3. Juniper lists 7.0.5, 7.1.7 and 7.2.3, and subsequent releases in the respective lines, as fixed. [1][2][3]
Juniper lists no known workaround for either flaw and says it is not aware of malicious exploitation. That statement does not establish that exploitation has never occurred. [1][2]
Still unconfirmed
- The checked records do not establish how many vulnerable devices are exposed to untrusted networks.
Sources
References support the numbered facts above. Source checks: 29 Oct 2026, 12:47 UTC.
The vendor's support-page application did not expose its bulletin text. The actual vendor-authored CVE records were read instead and checked against independent technical reporting. Exploit instructions are omitted.
- CVE-2026-103409: Session Smart Router authentication flaw
Juniper Networks, via the CVE Program · Primary source · 28 Oct 2026
Actual Juniper-authored CNA record read, including affected versions and the pre-onboarding restriction.
- CVE-2026-103406: Session Smart Conductor command injection
Juniper Networks, via the CVE Program · Primary source · 28 Oct 2026
Actual Juniper-authored CNA record; shares the same vendor origin as source 1, rather than counting as a second independent issuer.
- Juniper Session Smart Router Vulnerability: 18 CVEs, Two Rated 9.8
Brandefense Research Team · Reporting · 28 Oct 2026
Separate security research company's technical assessment, checked directly. Its vulnerability descriptions draw on Juniper's bulletin and CVE records, with that shared origin disclosed.