Advisory · CVE-2026-106079
Root command execution via YANG configuration on Juniper Session Smart routers and conductors
An attacker with config-write privileges can run arbitrary commands as root through the YANG configuration on Juniper Session Smart Router and Conductor. Juniper rates it 8.8.
- Vendor
- Juniper Networks
- Product
- Session Smart Router and Session Smart Conductor
- Identifier / CWE
- CVE-2026-106079
CWE-78 - Action timing
- Immediate
Explain it like I’m five
Someone allowed to edit the configuration can smuggle a system command into a config value, and the device runs it as root.
- 01Config-write privileges
An attacker holds privileges to write configuration.
- 02Crafted YANG value
The attacker submits a crafted value through AccessManager in the YANG configuration.
- 03Root execution
The injected command runs as root on the router or conductor.
What happened
Juniper disclosed Session Smart releases before 7.0.5, 7.1.0 through 7.1.6, and 7.2.0 through 7.2.2 as affected for Session Smart Router and Session Smart Conductor. An OS Command Injection vulnerability in AccessManager allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YANG configuration. Juniper rates it 8.8.
Config-write access is a legitimate operator capability, so the danger here is privilege escalation: a junior operator account or a compromised automation credential becomes root on network infrastructure.
What to do
- Inventory Session Smart Router and Conductor deployments.
- Upgrade to 7.0.5, 7.1.7, or 7.2.3 or later on the matching release line.
- Audit config-write accounts and automation credentials.
- Review configuration change logs for suspicious values or unexpected commands.
- Confirm the deployed version after patching.
Management note
This is the classic operator-to-root escalation: the blast radius of every config-write account is the whole device. Tighten those accounts while patching.