Juniper Networks has patched 18 vulnerabilities in its Session Smart Router and Session Smart Conductor, including two critical-severity flaws that could give an attacker unauthenticated control of network infrastructure. The fixes, published in advisory JSA112183 and reported on 29 October 2026, cover arbitrary command execution and privilege escalation. Juniper says it found the flaws internally and is not aware of any being exploited in the wild.

Two critical flaws lead the patch batch

The most serious flaw, CVE-2026-103409, carries a CVSS score of 9.8. It is a missing-authentication weakness in Session Smart Router that lets an unauthenticated network attacker obtain administrator privileges by passing crafted URL parameters to an internal endpoint running as root. There is one important limit: it can only be exploited before the device is onboarded to Mist or Conductor, and once onboarded it can no longer be exploited. The second critical flaw, CVE-2026-103406, also scored 9.8, is an operating-system command injection in Session Smart Conductor that could let an attacker run commands as root. The remaining flaws include high-severity file read, write and deletion, code execution, information disclosure and denial-of-service issues.

What operators should do

Operators should upgrade to Session Smart Router and Session Smart Conductor versions 7.0.5, 7.1.7 or 7.2.3, depending on their release line. Devices that have not yet been onboarded to Mist or Conductor deserve attention first, since the unauthenticated administrator flaw only affects that pre-onboarding window. Routers and conductors sit at the heart of enterprise networks, so a compromised device could disrupt traffic or serve as a foothold for deeper intrusion, which is why Juniper's batch is worth prioritising even without reports of active exploitation.

Sources: SecurityWeek and Juniper Networks advisory JSA112183.