---
id: "CVE-2026-103409"
kind: "vulnerability"
aliases: ["CVE-2026-103409"]
title: "Juniper Session Smart Router: unauthenticated network attacker gains admin via URL parameters"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "juniper", "mist-conductor", "network-appliance", "session-smart-router"]
not_affected_if: ["onboarded-to-mist-conductor"]
published_at: "2026-10-28T17:17:27+00:00"
first_seen_at: "2026-10-28T17:34:08+00:00"
updated_at: "2026-10-28T17:34:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103409", "first_seen_at": "2026-10-28T17:34:08+00:00"}]
---

# Juniper Session Smart Router: unauthenticated network attacker gains admin via URL parameters

Juniper Session Smart Router has an endpoint that runs as root and skips authentication, so a network attacker can send crafted URL parameters to gain administrative privileges. The flaw can only be exploited before the device is onboarded to Mist/Conductor, and not after.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the router is onboarded to Mist/Conductor; the sources say exploitation is no longer possible after onboarding
- Check the Session Smart Router software version against the fixed release in Juniper's advisory (unknown in these sources)

## Fix

- Onboard the device to Mist/Conductor, which the sources say removes the exploit path
- Apply the fixed Session Smart Router release from Juniper's advisory (version unknown in these sources)

## Timeline

- 2026-10-28T17:34:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103409

## From the sources

A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root.

Note that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_