---
title: Juniper fixes 18 Session Smart Router and Conductor bugs, including two CVSS 9.8 flaws: root command injection on Conductor through a crafted Salt minion ID, and admin takeover of routers that are not yet onboarded | ctxsec
url: https://ctxsec.com/items/juniper-session-smart-cve-2026-103406-103409-critical
description: ""
status: "official (Juniper JSA112183 and CVE records, Oct 28); found internally, no exploitation known"
published: 2026-10-29
---

> 

[← Cybersecurity News](/news) · [markdown](/items/juniper-session-smart-cve-2026-103406-103409-critical.md)

official (Juniper JSA112183 and CVE records, Oct 28); found internally, no exploitation known

2026-10-29

### Juniper fixes 18 Session Smart Router and Conductor bugs, including two CVSS 9.8 flaws: root command injection on Conductor through a crafted Salt minion ID, and admin takeover of routers that are not yet onboarded

- **CVE-2026-103406 (Session Smart Conductor, 9.8):** OS command injection in the AutomatedProvisioner lets a remote, unauthenticated attacker run commands as root during key management by supplying a crafted Salt minion ID.
- **CVE-2026-103409 (Session Smart Router, 9.8):** an insecure endpoint running as root accepts crafted URL parameters without authentication and hands out administrative privileges. It can only be exploited **before** the router is onboarded to Mist or a Conductor.
- **Fixed in:** 7.0.5, 7.1.7 and 7.2.3 and later for both products. Juniper lists no workarounds. The bulletin covers 16 more high and medium bugs (file read/write, privilege escalation, DoS).

**What to do:** upgrade Conductors first, since they control the fleet. For routers, do not leave freshly deployed units reachable before onboarding; stage them on an isolated network, onboard them, then expose them. Separately, Juniper says CVE-2026-109618 (PHP2Shell) affects Junos OS but not in an exploitable way (as reported by SecurityWeek).

Sources: [Juniper JSA112183: 2026-10 On-Demand Security Bulletin, Session Smart Router and Conductor, multiple internally discovered vulnerabilities (Oct 28)](https://supportportal.juniper.net/JSA112183) · [SecurityWeek: Adobe, Veeam, Juniper Networks patch critical vulnerabilities (Oct 29)](https://www.securityweek.com/adobe-veeam-juniper-networks-patch-critical-vulnerabilities/) · [CVE-2026-103406 record](https://www.cve.org/CVERecord?id=CVE-2026-103406) · [CVE-2026-103409 record](https://www.cve.org/CVERecord?id=CVE-2026-103409)