{"id":"CVE-2026-103403","kind":"vulnerability","aliases":["CVE-2026-103403"],"related":[],"title":"Juniper Session Smart Router: command injection via audit rule deletion","description":"An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of an audit rule.","summary":"AccessManager in Juniper Session Smart Router and Session Smart Conductor passes input unsafely to an OS command when an audit rule is deleted. An attacker can delete arbitrary files and run arbitrary commands on the device.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","juniper","network-appliance","session-smart-conductor","session-smart-router"],"not_affected_if":["management-not-reachable","no-juniper-ssr"],"how_to_check":"Run 'show system version' on each SSR router and Conductor and compare with the fixed releases in Juniper's bulletin for this CVE (not yet confirmed). List accounts that can reach AccessManager audit-rule management; the CVSS vector says a low-privileged login is required.","fix":null,"status":"open","published_at":"2026-10-28T17:17:24+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","triaged_at":"2026-10-28T17:34:21+00:00","updated_at":"2026-10-28T17:36:05+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-28T17:34:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Juniper Session Smart Router: command injection via audit rule deletion","impact":"high","summary":"AccessManager in Juniper Session Smart Router and Session Smart Conductor passes input unsafely to an OS command when an audit rule is deleted. An attacker can delete arbitrary files and run arbitrary commands on the device.","category":"infrastructure","nicknames":[],"who_cares":["juniper","session-smart-router","session-smart-conductor","network-appliance"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands and deletes arbitrary files on the device","analyst_note":"Find Juniper's advisory for affected and fixed versions, and whether an account is needed to delete an audit rule; check https://nvd.nist.gov/vuln/detail/CVE-2026-103403.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Operators running Juniper Session Smart Router or Session Smart Conductor with AccessManager. The sources do not list affected versions or whether a particular configuration is required. Teams without these Juniper products can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000561,"input_tokens":3325,"output_tokens":456,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Juniper's advisory for affected and fixed versions, and whether an account is needed to delete an audit rule; check https://nvd.nist.gov/vuln/detail/CVE-2026-103403.","search":"'-103403':13A,16A '-2026':12A,15A 'accessmanag':30B,82C 'allow':93C 'applianc':21B 'arbitrari':57B,61B,98C,102C 'attack':54B,95C 'audit':8A,49B,110C 'command':5A,46B,62B,76C,78C,103C 'conductor':25B,39B,92C 'cve':11A,14A 'delet':10A,52B,56B,100C,107C 'devic':65B 'element':71C 'execut':104C 'file':58B,99C 'improp':67C 'infrastructur':17B 'inject':6A,79C 'input':41B 'junip':1A,18B,32B,84C 'network':20B,85C 'network-appli':19B 'neutral':68C 'os':45B,75C,77C 'pass':40B 'perform':97C 'router':4A,29B,35B,88C 'rule':9A,50B,111C 'run':60B 'session':2A,23B,27B,33B,37B,86C,90C 'session-smart-conductor':22B 'session-smart-rout':26B 'smart':3A,24B,28B,34B,38B,87C,91C 'special':70C 'unsaf':42B 'use':72C 'via':7A,105C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Teams running Juniper Session Smart Router or Session Smart Conductor with AccessManager. Juniper's CVSS vector (network, low complexity, low privileges required) means an attacker needs a valid low-privileged account but can then delete files and run commands on the device. Affected and fixed versions are not yet confirmed. Teams without these Juniper products can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"sirt@juniper.net","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103403","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103403","severity":null,"published_at":"2026-10-28T17:17:24+00:00","modified_at":"2026-10-28T17:17:25+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","fetched_at":"2026-10-28T17:34:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103403:968","url":null,"severity":null,"published_at":"2026-10-28T17:36:05+00:00","modified_at":"2026-10-28T17:36:05+00:00","first_seen_at":"2026-10-28T17:36:05+00:00","fetched_at":"2026-10-28T17:36:05+00:00","note":"Juniper bulletin not readable (supportportal is JS-only); NVD page empty via web-cli. CVSS vector from Juniper (AV:N/AC:L/PR:L/UI:N) means a low-privileged authenticated account is needed, not pre-auth. CERT-FR AVI-1337 (JSA112528, 16 Oct) lists SSR <7.0.5, 7.1.x <7.1.7, 7.2.x <7.2.3 but does not name this CVE, so not applied as fixed versions. Nothing verified; no exploitation or PoC found. Revisit when Juniper JSA text is available."}],"documents":[{"id":11632,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103403","title":"NVD: CVE-2026-103403 (CNA Juniper, CVSS 8.8)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}