CVE-2026-103409 | Vulnetix

CVE-2026-103409 PUBLISHED CVSS 9.8 CRITICAL

Reported by juniper · Published October 28, 2026

A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor.

EPSS 0.35% · 28.5th percentile

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
Session Smart Router	Juniper Networks	7.2.3, 7.1.7, 7.0.5

Risk scores

CVSS 3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.35%

28.5th percentile

Affected products

Vendor	Product	Versions
Juniper Networks	Session Smart Router	0, 7.1.0, 7.2.0
Juniper Networks	Session Smart Router	0, 7.1.0, 7.2.0

Timeline

Oct 28, 2026 CVE Published
Oct 29, 2026 EPSS Score (2 in total, the first dated here)
Oct 29, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-103409
vulnetix vdb fixes CVE-2026-103409

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-103409/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

vendor-advisory

Look up in the Resolve Platform →