Loading vulnerability…
Root Command Injection in Juniper Session Smart AccessManager
CVE-2026-106079 is an OS command injection vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor. Improper validation and neutralization of a field when updating the YANG configuration allows an attacker with config-write privileges to execute arbitrary operating-system commands as root. Affected releases include versions before 7.0.5, 7.1.x before 7.1.7, and 7.2.x before 7.2.3. The vulnerability has a CVSS v3.1 score of 8.8 and supports network-based exploitation without user interaction.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation escalates configuration-write access to root-level command execution, potentially compromising the affected router or conductor's confidentiality, integrity, and availability. An attacker could access sensitive information, modify system configuration or files, and disrupt services.
If you can’t patch tonight, do this now.
No vendor-confirmed workaround is specified. As interim precautions, restrict config-write privileges to essential trusted administrators and limit network access to configuration management interfaces. These restrictions reduce exposure but do not correct the underlying command injection.
Patch, then assume compromise.
Upgrade affected Session Smart Router and Session Smart Conductor installations to version 7.0.5, 7.1.7, or 7.2.3, or a later fixed release in the applicable branch, following Juniper advisory JSA112183.
No public exploits tracked yet. Mallory keeps watching.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.