High priorityDisclosed

Advisory · CVE-2026-103403

Command injection via audit rule deletion on Juniper Session Smart routers and conductors

A low-privileged attacker can delete arbitrary files and run arbitrary commands through the AccessManager audit rule deletion path on Juniper Session Smart Router and Conductor. Juniper rates it 8.8.

Advisory published October 28, 2026Independent summary
Vendor
Juniper Networks
Product
Session Smart Router and Session Smart Conductor
Identifier / CWE
CVE-2026-103403
CWE-78
Action timing
Immediate
ELI5

Explain it like I’m five

Deleting an audit rule is supposed to remove one entry. Instead the delete request is pasted into a system command, so a crafted request deletes any file and runs commands.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Low-privileged access

    An attacker holds low privileges on the router or conductor.

  2. 02Crafted audit rule deletion

    The attacker triggers deletion of an audit rule with a crafted value.

  3. 03Command execution

    AccessManager executes arbitrary commands and deletes arbitrary files.

What happened

Juniper disclosed Session Smart releases before 7.0.5, 7.1.0 through 7.1.6, and 7.2.0 through 7.2.2 as affected for Session Smart Router and Session Smart Conductor. An OS Command Injection vulnerability in AccessManager allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of an audit rule. Juniper rates it 8.8 with low privileges required.

The audit subsystem is supposed to record security events; a flaw that turns audit deletion into command execution also undermines the logs teams would use to investigate it, so check for gaps as well as intrusions.

What to do

  1. Inventory Session Smart Router and Conductor deployments.
  2. Upgrade to 7.0.5, 7.1.7, or 7.2.3 or later on the matching release line.
  3. Limit low-privileged access to AccessManager functions until patched.
  4. Review audit logs for unusual rule deletions, missing files, or unexpected commands.
  5. Confirm the deployed version after patching.

Management note

A flaw inside the auditing path is doubly bad: it grants execution and can erase the evidence. Treat log review as part of the patch task, not an afterthought.