Juniper fixes 18 flaws in Session Smart routers and Conductor

Juniper Networks has released a security bulletin, JSA112183, confirming 18 vulnerabilities across its Session Smart Router and Session Smart Conductor management platform. Two flaws are rated CVSS v3.1 9.8: CVE-2026-103406, affecting Session Smart Conductor, and CVE-2026-103409, affecting the Session Smart Router itself. Unauthenticated attackers could trigger arbitrary command execution during key management on Conductor or obtain administrative privileges on the router via an unauthenticated internal endpoint.

Juniper notes that these issues affect all versions of both products, and testing by Juniper’s own SIRT corroborates exploitation potential.

The remaining vulnerabilities span high and lower severities, with several rated 8.8 and described as exploitable with low-privilege access. Examples cited include a lack of integrity verification in cache files and a remote code execution path via crafted DHCP options from an adjacent network. Other flaws cover crashes, memory errors, and HTTP response splitting. Affected versions are all Session Smart Router and Session Smart Conductor versions prior to 7.0.5, 7.1.7, and 7.2.3.

The guidance provided is to upgrade to 7.0.5, 7.1.7, 7.2.3 or any later release, with Juniper stating there are no known workarounds for these issues. Until patched, Juniper advises restricting access to Conductor and the router management interfaces, as a protective measure against exploitation.