Juniper Patches Critical CVSS 9.8 Flaws in Session Smart Router and Conductor

On October 28, Juniper published a security bulletin covering vulnerabilities in Session Smart Router and Session Smart Conductor. The fixes ship in releases 7.0.5, 7.1.7, and 7.2.3. The Canadian Centre for Cyber Security has also issued an advisory for both products.

What was disclosed

Bulletin JSA112183 describes vulnerabilities found during internal security testing. The most serious are CVE-2026-103406 in Conductor, which allows command execution without authentication, and CVE-2026-103409 in Router, which allows an attacker to gain administrator privileges. Both have a CVSS score of 9.8.

The documentation notes an important condition for CVE-2026-103409: it can only be exploited on a device that hasn’t yet been onboarded to Mist or Conductor. Factor this condition in when you assess your exposure.

Juniper says it is not aware of any malicious exploitation of these vulnerabilities. So although the flaws are rated critical, there’s no confirmed attack campaign underway.

Who needs to patch

Canadian advisory AV26-1101 lists the affected versions as those earlier than the fixed releases in the 7.0, 7.1, and 7.2 branches. Organizations that run Router and Conductor should check both products.

When deciding how urgently to patch, consider how exposed your management interfaces are, which stage of deployment each device is at, and how much your network depends on each node. Juniper doesn’t offer a single workaround that addresses all of the issues.

What to do now

• Inventory the versions of every Session Smart Router and Conductor installation.
• Review the conditions for each vulnerability in the bulletin and the related CVE records.
• Plan an upgrade to the fixed release in the relevant branch, or to a newer release recommended by Juniper.
• Back up your configuration before upgrading, and decide how you’ll confirm that routing works correctly after the change.
• Check who can reach management services and devices that are being prepared for deployment.

SecurHUB’s take

Updating network infrastructure means weighing the vulnerability risk against the need to keep the network available. Network security audits help you map your exposure and confirm that administrative access matches what your organization actually needs.

Sources: Juniper, Canadian Centre for Cyber Security, Brandefense