Critical severity · published Oct 28, 2026
CVE-2026-103409
Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed
New
9.8
CVSS
–
EPSS
No
On KEV
Description
A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root.
Note that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Session Smart Router · Juniper Networks
before 7.0.5; 7.1.0 before 7.1.7; 7.2.0 before 7.2.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-103409
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-103409
vendor-advisory
https://supportportal.juniper.net/JSA112183
More from Session Smart Router
10.0
CVE-2024-2973
Session Smart Router(SSR): On redundant router deployments API authentication can be bypassed
9.8
CVE-2025-21589
Session Smart Router, Session Smart Conductor, WAN Assurance Router: API Authentication Bypass vulnerability
8.8
CVE-2026-106079
Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration
8.8
CVE-2026-103408
Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options
8.8
CVE-2026-103407
Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management