Juniper Session Smart Router: OS command injection in AccessManager
Summary
Juniper Session Smart Router and Session Smart Conductor contain an OS command injection (CWE-78) in the AccessManager component. An attacker with config-write privileges can run arbitrary commands as root through the YANG configuration. The flaw is not exploitable without these privileges, but the impact is full control of the device.
Affected
- Session Smart Router: versions before 7.0.5, 7.1.0 to before 7.1.7, 7.2.0 to before 7.2.3
- Session Smart Conductor: versions before 7.0.5, 7.1.0 to before 7.1.7, 7.2.0 to before 7.2.3
Fixed in
- 7.0.5 and all subsequent releases
- 7.1.7 and all subsequent releases
- 7.2.3 and all subsequent releases
Workaround
No known workarounds according to the CNA record.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- No public exploit was found in the sources checked.
- VulDB estimates an exploit price of USD 5k-25k. This is a market estimate, not evidence of use.
Our recommendation
- Upgrade Session Smart Router and Session Smart Conductor to 7.0.5, 7.1.7, 7.2.3 or a later release.
- Restrict config-write rights to required administrators and review existing accounts.
- Limit access to management interfaces until the patch is applied.
- Patch together with the more severe issues in JSA112183, such as CVE-2026-103406 and CVE-2026-103409.
- Prioritise Conductor systems and any reachable management interfaces.
- Verify version data against JSA112183 before rollout.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112183 supportportal.juniper.net
- OffSeq: CVE-2026-106079 radar.offseq.com
- VulDB: CVE-2026-106079 vuldb.com
- Strix: CVE-2026-106079 www.strix.ai
- ThreatInt: CVE-2026-106079 cve.threatint.com
- SecurityOnline: Session Smart Router vulnerabilities securityonline.info
- OffSeq: CVE-2026-103406 (Conductor command injection) radar.offseq.com
- OffSeq: CVE-2026-103409 (missing authentication) radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:27.
Original description (NVD)
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YANG configuration.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.