JSA112183 fixes eight flaws, including root command injection on Conductor via a salt minion ID and admin access to unonboarded routers. Upgrade now.
Juniper Networks published security bulletin JSA112183 on 28 October 2026, fixing eight vulnerabilities in Session Smart Router (SSR) and Session Smart Conductor. Two score 9.8 and need no credentials: CVE-2026-103406 gives a remote attacker root command execution on the Conductor, and CVE-2026-103409 gives an attacker administrative access to a Router that has not yet been onboarded. Juniper lists no workarounds for either. Its SIRT is not aware of malicious exploitation of the flaws, according to the CVE records for 103406, 103409 and 103403.
Who is affected
The affected releases are everything before 7.0.5, 7.1.0 up to but not including 7.1.7, and 7.2.0 up to but not including 7.2.3. Fixes ship in 7.0.5, 7.1.7, 7.2.3 and later releases. These ranges are confirmed in the CVE records for 103406, 103409 and 103403; check the bulletin for the remaining five.
The critical pair
CVE-2026-103406 (CVSS 9.8, Conductor). An OS command injection in the AutomatedProvisioner lets a remote attacker run arbitrary commands as root through a specially crafted salt minion ID. The CVSS vector (AV:N/AC:L/PR:N/UI:N) means network reachable, low complexity, no privileges and no user interaction. The CVE title ties it to key management. Juniper states no workarounds exist.
CVE-2026-103409 (CVSS 9.8, Router). An unauthenticated internal endpoint that runs as root accepts crafted URL parameters, and an unauthenticated network attacker can use it to gain administrative privileges. It is classed CWE-306, missing authentication for a critical function. Exploitation is possible only before the device is onboarded to Mist or Conductor and is not possible afterwards. Juniper reports the defect (I95-65016) was found internally and that there are no known workarounds. Routers that are deployed but not yet onboarded, or being staged, are the exposure.
The rest of the bulletin
| CVE | Product | Issue | CVSS |
|---|---|---|---|
| CVE-2026-103403 | Router and Conductor | AccessManager command injection and arbitrary file deletion when an audit rule is deleted | 8.8 |
| CVE-2026-103407 | Router and Conductor | ConfigDirector path traversal; an authenticated REST user can read, overwrite or delete certificate and key files | 8.8 |
| CVE-2026-103408 | Router | Stack buffer overflow in the DHCP client; RCE from a malicious DHCP reply by an unauthenticated attacker on the local network | 8.8 |
| CVE-2026-103410 | Router | Integer overflow in the DPI certificate scanner; DoS via a crafted TLS server certificate | 7.5 |
| CVE-2026-103404 | Conductor | Insecure /tmp permissions expose routing credentials to a local user | 6.8 |
| CVE-2026-103405 | Router and Conductor | HTTP response splitting through unsanitized request body parameters | 5.8 |
The certificate and key file access in 103407 and the credential exposure in 103404 matter because they reach material that secures the fabric, beyond the single host.
The eight CVEs in JSA112183 by CVSS score: two sit at 9.8 with no workaround, and the rest range from 8.8 down to 5.8.
What defenders should do
- Upgrade to 7.0.5, 7.1.7, 7.2.3 or later. With no workarounds, patching is the only fix.
- Prioritise Conductors, since 103406 is root execution without authentication.
- Keep Conductor management interfaces off untrusted networks until patched. This is general hardening, not a Juniper-stated mitigation.
- Onboard new Routers to Mist or Conductor promptly and keep unonboarded devices off reachable networks, because 103409 applies only before onboarding.
- Review audit-rule deletions and REST certificate/key API use on unpatched systems for signs of abuse of 103403 and 103407.