Loading vulnerability…
OS Command Injection in Juniper Session Smart AccessManager
CVE-2026-103403 is an operating-system command injection vulnerability in the AccessManager component of Juniper Networks Session Smart Router and Session Smart Conductor. Improper neutralization of special elements in input used during audit-rule deletion allows an attacker to delete arbitrary files and execute arbitrary operating-system commands. The vulnerability is network-accessible and requires low privileges but no user interaction. Affected releases precede fixes in versions 7.0.5, 7.1.7, and 7.2.3 in their respective release branches.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary file deletion and operating-system command execution, potentially exposing sensitive information, compromising system integrity, and disrupting services. The CVSS v3.1 assessment assigns high confidentiality, integrity, and availability impacts, with a base score of 8.8. The execution account and whether commands execute with root privileges are not specified.
Patch, then assume compromise.
Upgrade affected Session Smart Router and Session Smart Conductor installations to version 7.0.5 or later in the 7.0 branch, 7.1.7 or later in the 7.1 branch, or 7.2.3 or later in the 7.2 branch. Follow Juniper security advisory JSA112183 for applicable upgrade instructions.
No public exploits tracked yet. Mallory keeps watching.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.