---
id: "CVE-2026-103403"
kind: "vulnerability"
aliases: ["CVE-2026-103403"]
title: "Juniper Session Smart Router: command injection via audit rule deletion"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "juniper", "network-appliance", "session-smart-conductor", "session-smart-router"]
not_affected_if: ["management-not-reachable", "no-juniper-ssr"]
published_at: "2026-10-28T17:17:24+00:00"
first_seen_at: "2026-10-28T17:34:08+00:00"
updated_at: "2026-10-28T17:36:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103403", "first_seen_at": "2026-10-28T17:34:08+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-28T17:36:05+00:00"}]
---

# Juniper Session Smart Router: command injection via audit rule deletion

AccessManager in Juniper Session Smart Router and Session Smart Conductor passes input unsafely to an OS command when an audit rule is deleted. An attacker can delete arbitrary files and run arbitrary commands on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Run 'show system version' on each SSR router and Conductor and compare with the fixed releases in Juniper's bulletin for this CVE (not yet confirmed). List accounts that can reach AccessManager audit-rule management; the CVSS vector says a low-privileged login is required.

## Timeline

- 2026-10-28T17:34:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103403
- 2026-10-28T17:36:05+00:00 analyst — Juniper bulletin not readable (supportportal is JS-only); NVD page empty via web-cli. CVSS vector from Juniper (AV:N/AC:L/PR:L/UI:N) means a low-privileged authenticated account is needed, not pre-auth. CERT-FR AVI-1337 (JSA112528, 16 Oct) lists SSR <7.0.5, 7.1.x <7.1.7, 7.2.x <7.2.3 but does not name this CVE, so not applied as fixed versions. Nothing verified; no exploitation or PoC found. Revisit when Juniper JSA text is available.

## Documents

- [advisory] NVD: CVE-2026-103403 (CNA Juniper, CVSS 8.8) https://nvd.nist.gov/vuln/detail/CVE-2026-103403

## From the sources

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of an audit rule.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_