Live › vulnerability › CVE-2026-103403
Go to dashboardAccessManager in Juniper Session Smart Router and Session Smart Conductor passes input unsafely to an OS command when an audit rule is deleted. An attacker can delete arbitrary files and run arbitrary commands on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Teams running Juniper Session Smart Router or Session Smart Conductor with AccessManager. Juniper's CVSS vector (network, low complexity, low privileges required) means an attacker needs a valid low-privileged account but can then delete files and run commands on the device. Affected and fixed versions are not yet confirmed. Teams without these Juniper products can skip it.
No product ranges from the sources yet.
show system version on each SSR router and Conductor and compare with the fixed releases in Juniper's bulletin for this CVE (not yet confirmed)Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of an audit rule.
This page as .md · .json · in your agent: get_signal("CVE-2026-103403")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.