Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-103409: Juniper Session Smart Router lets unauthenticated attacker gain admin
CVE-2026-103409 · published 12 days ago
Summary
The Session Smart Router can be accessed without any login, letting a network attacker take full control of the device. This risk only exists before the router is linked to Juniper’s Mist/Conductor management system, after which the flaw is closed. Apply the latest software update and enroll the router in Mist/Conductor as soon as possible to eliminate the exposure.
What to do
- Update juniper networks session smart router to version 7.0.5 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| juniper networks | session smart router | < 7.0.5 |
Original advisory text
Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed
A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root.
Note that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor.
Note that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor.
References
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published28 Oct 2026
Updated7 Nov 2026
First seen28 Oct 2026
Track software like this
Free during beta