---
id: "CVE-2026-106079"
kind: "vulnerability"
aliases: ["CVE-2026-106079"]
title: "Juniper Session Smart Router: config-write user can run commands as root"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "juniper", "network-appliance", "session-smart-conductor", "session-smart-router"]
not_affected_if: ["no-config-write-users"]
published_at: "2026-10-28T17:17:32+00:00"
first_seen_at: "2026-10-28T17:34:08+00:00"
updated_at: "2026-10-28T17:35:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106079", "first_seen_at": "2026-10-28T17:34:08+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-28T17:35:10+00:00"}]
---

# Juniper Session Smart Router: config-write user can run commands as root

AccessManager in Juniper Session Smart Router and Session Smart Conductor fails to neutralize OS command characters in YANG configuration. An attacker with config-write privileges can execute arbitrary commands as root.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Unknown until Juniper's bulletin is read: check the SSR/Conductor version (show system version on the Conductor/router) against the fixed versions in the Juniper bulletin, and list which accounts hold config-write (admin) rights.

## Timeline

- 2026-10-28T17:34:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106079
- 2026-10-28T17:35:10+00:00 analyst — Juniper bulletin for this CVE not readable (supportportal is JS-only, cve.org record empty via web-cli). No affected/fixed versions confirmed. CERT-FR AVI-1337 (JSA112528, 16 Oct) lists SSR <7.0.5, 7.1.x <7.1.7, 7.2.x <7.2.3 but does not name this CVE, so not applied. Nothing verified; no exploitation or PoC found. Revisit when NVD/Juniper text is available.

## Documents

- [advisory] CVE Record: CVE-2026-106079 (CNA: Juniper Networks) https://www.cve.org/CVERecord?id=CVE-2026-106079

## From the sources

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YANG configuration.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_