Live › vulnerability › CVE-2026-103409
Go to dashboardJuniper Session Smart Router has an endpoint that runs as root and skips authentication, so a network attacker can send crafted URL parameters to gain administrative privileges. The flaw can only be exploited before the device is onboarded to Mist/Conductor, and not after.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Owners of Juniper Session Smart Router devices that have not yet been onboarded to Mist/Conductor and are reachable from the network. Devices already onboarded to Mist/Conductor are stated to be no longer exploitable, so they can skip the urgent response.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root.
Note that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor.
This page as .md · .json · in your agent: get_signal("CVE-2026-103409")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.