CVE-2026-103409 is a critical (CVSS 9.8) missing-authentication flaw in Juniper Networks Session Smart Router: an unauthenticated attacker on the network can get administrative privileges on a device that has not yet been onboarded to Mist/Conductor.
What Is It
CVE-2026-103409 is a missing authentication for critical function vulnerability (CWE-306) in Juniper Networks Session Smart Router. According to the NVD record, an attacker sends crafted URL parameters to an insecure endpoint that runs as root. That gives them administrative privileges on the device without any credentials.
Juniper's SIRT published the record on October 28, 2026. NVD lists it as "Awaiting Analysis."
Why It Matters
Juniper rates the flaw CVSS 3.1 9.8 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means:
- It can be exploited over the network.
- Attack complexity is low.
- It needs no privileges and no user interaction.
- A successful attack fully compromises confidentiality, integrity and availability.
The vulnerable endpoint runs as root, so an attacker gets administrative control of a network routing device.
There is one important limit. Juniper says the flaw can only be exploited before the device is onboarded to Mist/Conductor. Once a device is onboarded, the issue can no longer be exploited. Devices most at risk are new deployments, staged hardware, and routers that are reachable on the network but not yet onboarded.
This CVE has no CISA Known Exploited Vulnerabilities (KEV) entry, so the supplied data does not confirm active exploitation.
What's Vulnerable
Juniper Networks Session Smart Router versions:
- All versions before 7.0.5
- 7.1.0 up to but not including 7.1.7
- 7.2.0 up to but not including 7.2.3
Versions outside these ranges are listed as unaffected.
Patch Status
The affected ranges end at 7.0.5, 7.1.7, and 7.2.3, so those releases are outside the vulnerable range. Organizations should move Session Smart Router deployments to one of those versions or later on their release train. Full remediation details are in Juniper advisory JSA112183.
Until devices are upgraded, onboarding them to Mist/Conductor closes the exploitation window, according to Juniper's description. Teams should check for any Session Smart Router that is network-reachable but not yet onboarded and prioritize it.
No CISA KEV required action or due date applies, because the CVE is not in the KEV catalog.