Loading vulnerability…
Unauthenticated Administrative Access in Juniper Session Smart Router
CVE-2026-103409 is a missing-authentication vulnerability in Juniper Networks Session Smart Router. An unauthenticated network attacker can obtain administrative privileges by supplying crafted URL parameters to an insecure endpoint running as root. Exploitation is possible only before the device is onboarded to Mist or Conductor; after onboarding, the vulnerability is no longer exploitable. Fixed releases are 7.0.5, 7.1.7, and 7.2.3 in their respective release branches.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation grants administrative privileges on an affected router without authentication, compromising administrative access controls. This can enable unauthorized access to sensitive information, modification of device configuration, and disruption of router operation, with potentially high confidentiality, integrity, and availability impacts.
If you can’t patch tonight, do this now.
Complete device onboarding to Mist or Conductor, after which this vulnerability is no longer exploitable. While devices await onboarding, restrict network access to the vulnerable endpoint to trusted provisioning and management systems.
Patch, then assume compromise.
Upgrade Juniper Networks Session Smart Router to a fixed release: 7.0.5 or later in the 7.0 branch, 7.1.7 or later in the 7.1 branch, or 7.2.3 or later in the 7.2 branch. Follow the upgrade guidance in Juniper advisory JSA112183.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.