Juniper fixes Session Smart Router and Conductor flaws that need no login

Juniper Networks disclosed two flaws on Oct 28 in Session Smart Conductor and Session Smart Router that a remote attacker can exploit without a login. CVE-2026-103406 lets an attacker run commands as root on Conductor, and CVE-2026-103409 gives administrator privileges on a router that hasn’t been onboarded yet. Its fixed releases are 7.0.5, 7.1.7 and 7.2.3, and it knows of no attacks.

On Conductor, an attacker can inject operating system commands into the AutomatedProvisioner with a crafted salt minion ID, which runs them as root, Juniper’s CVE record says. Juniper lists no workaround.

On the router, an internal endpoint that runs as root doesn’t check who is calling it. An attacker on the network can pass crafted URL parameters to it and get administrator privileges. This works only before the router is onboarded to Mist or Conductor, Juniper says, and it lists no workaround.

Juniper’s CVSS 3.1 score of 9.8 for each means an attack over the network, with low complexity and no privileges or user action, puts confidentiality, integrity and availability at stake.

Juniper’s own staff found both flaws, and its bulletin JSA112183 covers several flaws found the same way. Juniper tracks the Conductor flaw as I95-65205 and the router flaw as I95-65016, which can help when opening a support case. The Canadian Centre for Cyber Security flagged the bulletin on Oct 28.