Juniper fixes 18 Session Smart Router and Conductor bugs, including two CVSS 9.8 flaws: root command injection on Conductor through a crafted Salt minion ID, and admin takeover of routers that are not yet onboarded
- CVE-2026-103406 (Session Smart Conductor, 9.8): OS command injection in the AutomatedProvisioner lets a remote, unauthenticated attacker run commands as root during key management by supplying a crafted Salt minion ID.
- CVE-2026-103409 (Session Smart Router, 9.8): an insecure endpoint running as root accepts crafted URL parameters without authentication and hands out administrative privileges. It can only be exploited before the router is onboarded to Mist or a Conductor.
- Fixed in: 7.0.5, 7.1.7 and 7.2.3 and later for both products. Juniper lists no workarounds. The bulletin covers 16 more high and medium bugs (file read/write, privilege escalation, DoS).
What to do: upgrade Conductors first, since they control the fleet. For routers, do not leave freshly deployed units reachable before onboarding; stage them on an isolated network, onboard them, then expose them. Separately, Juniper says CVE-2026-109618 (PHP2Shell) affects Junos OS but not in an exploitable way (as reported by SecurityWeek).
Sources: Juniper JSA112183: 2026-10 On-Demand Security Bulletin, Session Smart Router and Conductor, multiple internally discovered vulnerabilities (Oct 28) · SecurityWeek: Adobe, Veeam, Juniper Networks patch critical vulnerabilities (Oct 29) · CVE-2026-103406 record · CVE-2026-103409 record