On October 28, 2026, NVD published two Juniper Networks CVEs rated 9.8 by Juniper, both in the Session Smart line: CVE-2026-103409 in the Session Smart Router and CVE-2026-103406 in the Session Smart Conductor, the console that manages the routers. Both lead to top-level privileges without an account.
What makes them worth a closer look: both target the provisioning phase. One only exists before a router is onboarded; the other sits in the Conductor's automated provisioning.
| CVE | Product | Class | CVSS 3.1 | Vector | NVD published |
|---|---|---|---|---|---|
| CVE-2026-103409 | Session Smart Router | Missing authentication (CWE-306) | 9.8 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | 2026-10-28 |
| CVE-2026-103406 | Session Smart Conductor | OS command injection (CWE-78) | 9.8 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | 2026-10-28 |
Scores come from Juniper as CNA. NVD lists both as Awaiting Analysis: no NVD score and no CPE configurations yet, so no affected version list in NVD. The only source for affected and fixed versions is Juniper bulletin JSA112183, referenced by both CVEs. Neither is in CISA KEV at the time of writing.
CVE-2026-103409: the router that isn't onboarded yet
An insecure endpoint running as root on the Session Smart Router accepts crafted URL parameters without authentication. A network attacker can use it to obtain administrative privileges.
The condition is specific: per Juniper, the flaw can only be exploited before the device is onboarded to Mist or Conductor. Once onboarded, it no longer can.
What that means in practice:
- a production router already attached to Mist or a Conductor isn't exposed to this CVE, according to the description;
- the risk window is the freshly unboxed or factory-reset router plugged into a network before it's been claimed. In SD-WAN rollouts, that step often happens on site, sometimes on a raw Internet link;
- a device stuck halfway through provisioning (failed onboarding, site never finished) stays exploitable until it's attached. That's an inference from the description, not something the bulletin states.
CVE-2026-103406: Conductor provisioning
In the Session Smart Conductor's AutomatedProvisioner component, a crafted salt minion ID lets a remote attacker execute arbitrary commands as root. Class: OS command injection.
"Salt minion" refers to SaltStack's architecture, where each managed device (minion) registers with a master using an identifier. One can infer that the ID a device announces ends up in a system command without proper neutralization, but NVD doesn't describe the path or the network prerequisites, so I'll stop there.
The stakes differ from a single router. The Conductor manages the whole fleet: root on the Conductor potentially means control over the configuration of every site it runs.
Detection
- Inventory: which Session Smart Routers are not onboarded today (spares, sites in progress, reset devices), and what network are they plugged into?
- Conductor: new minions or unexpected IDs, especially ones containing special characters
- Conductor system logs: processes spawned by provisioning that don't match a planned operation
- Accounts and configuration: admin accounts created or changed outside change control, configs pushed without a ticket
- Network flows from the Conductor to unusual destinations
For the rest of this month's Juniper news, see our article on CVE-2026-101950 and CVE-2026-102178 in Junos OS.
Mitigation
- Read JSA112183 and apply the fixed versions it lists, on routers and on the Conductor.
- Onboard routers on a controlled network: no provisioning over an open Internet link, and as little time as possible between power-on and attachment to Mist or the Conductor.
- Don't leave non-onboarded devices powered and reachable: spares, lab gear, sites abandoned mid-rollout.
- Restrict network access to the Conductor, especially its provisioning services, to the expected devices and management networks only.
- Update the images used to stage new routers, so future rollouts start from a fixed version.
Why Continuous Monitoring of Your Network Fleet Matters
Neither CVE has an NVD score or an NVD version list on release day: a tool that relies on CPE data alone can't see them yet. And the Conductor is a single box holding the whole fleet, with its own version that's easy to forget.
With cveo.tech, register your Session Smart routers and console with their versions and get alerted as soon as a CVE affects them, even before NVD analysis.