Act nowDisclosed

Advisory · CVE-2026-103409

Unauthenticated admin takeover of Juniper Session Smart Router before onboarding

Missing authentication on a root endpoint lets an unauthenticated network attacker gain administrative privileges on Juniper Session Smart Routers that have not yet been onboarded. Juniper rates it critical at CVSS 9.8.

Advisory published October 28, 2026Independent summary
Vendor
Juniper Networks
Product
Session Smart Router
Identifier / CWE
CVE-2026-103409
CWE-306
Action timing
Immediate
ELI5

Explain it like I’m five

A back door on the router answers admin requests without asking who is knocking, but only while the router is still waiting to be registered. Once it is registered, the door closes.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Unonboarded router

    The target router has not yet been onboarded to Mist or Conductor.

  2. 02Crafted URL parameters

    An unauthenticated network attacker sends crafted parameters to an insecure endpoint running as root.

  3. 03Admin privileges

    The attacker obtains administrative privileges on the router.

What happened

Juniper disclosed Session Smart releases before 7.0.5, 7.1.0 through 7.1.6, and 7.2.0 through 7.2.2 as affected. A Missing Authentication for Critical Function vulnerability in Session Smart Router lets an unauthenticated network-based attacker obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Juniper rates it critical at CVSS 3.1 9.8.

Juniper notes this can only be exploited before the device is onboarded to Mist or Conductor; once onboarded, the issue can no longer be exploited. That narrows exposure, but routers sitting unprovisioned in staging, warehouses, or branch closets are exactly the ones at risk.

What to do

  1. Inventory Session Smart Routers, including unprovisioned and staging units.
  2. Upgrade to 7.0.5, 7.1.7, or 7.2.3 or later on the matching release line.
  3. Onboard routers promptly and keep unonboarded units off untrusted networks.
  4. Review router logs for crafted URL parameter requests against administrative endpoints.
  5. Confirm the deployed version after patching.

Management note

This is a pre-onboarding window flaw, so asset tracking matters as much as patching: the vulnerable population is the set of routers nobody has finished setting up yet. Find those first.