# Juniper patches 19 flaws in Session Smart Router

Published: 2026-10-30 · Severity: routine
Canonical: https://vorant.io/reports/18cfffde-d6d2-56c2-8862-1056b46bcf93/juniper-session-smart-router-conductor-flaws-patched
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Juniper fixed 19 vulnerabilities in Session Smart Router and Session Smart Conductor, including unauthenticated root-level remote code execution rated up to CVSS 9.8.

Source: advisories.ncsc.nl — https://advisories.ncsc.nl/2026/ncsc-2026-0462.html

## What to check

- Applies to: The 18 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

NCSC-NL published an advisory summarizing 19 vulnerabilities patched by Juniper Networks in its Session Smart Router (SSR) and Session Smart Conductor products. The flaws span multiple components including the HTTP parser, TCP proxy, VRRPv3 handling, DHCP client, AccessManager, RoutingManager, ConfigDirector, and AutomatedProvisioner. Impacts range from service crashes, memory corruption and information disclosure to unauthenticated remote command execution as root, privilege escalation, arbitrary file read/write/delete, and OS command injection via crafted salt minion IDs or YANG configuration input.

Most severe among these are an unauthenticated API endpoint allowing local unprivileged users to overwrite arbitrary files as root, an insecure internal endpoint granting unauthenticated attackers administrative privileges, a stack-based buffer overflow in the DHCP client enabling remote code execution, and an AutomatedProvisioner flaw permitting unauthenticated remote command execution as root via crafted salt minion IDs (CVSS up to 9.8). Additional issues include decryption weaknesses from improper security-policy initialization, HTTP response splitting, insufficient file permission controls exposing routing data, and an integer overflow in the DPI TLS certificate scanner causing denial of service.

No in-the-wild exploitation is reported. Juniper has released updates addressing all listed CVEs; defenders running Session Smart Router or Session Smart Conductor should prioritize patching given the number of high/critical-rated issues (several CVSS 8.8–9.8) and the presence of unauthenticated remote code execution and privilege escalation vectors affecting critical network infrastructure.

## Mentioned in this report

- Vulnerabilities: CVE-2026-103390, CVE-2026-103391, CVE-2026-103392, CVE-2026-103393, CVE-2026-103394, CVE-2026-103400, CVE-2026-103401, CVE-2026-103402, CVE-2026-103403, CVE-2026-103404, CVE-2026-103405, CVE-2026-103406, CVE-2026-103407, CVE-2026-103408, CVE-2026-103409, CVE-2026-103410, CVE-2026-103411, CVE-2026-106079

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0462.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/53bcbfac-beb2-5b49-897f-83e0ab799ca2/juniper-patches-19-flaws-in-session-smart-router.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup