Session Smart Router path traversal and other flaws
Published · Juniper Networks · 10 CVEs · NVD and CISA KEV checked October 30, 2026
In short Juniper Networks has fixes for Session Smart Router and Session Smart Conductor flaws. Check affected releases and update.
What happened
Juniper Networks has issued fixes for vulnerabilities affecting Session Smart Router and Session Smart Conductor. Think of a software update as repairing several faulty locks: the repairs arrive together, but each lock represents a separate problem. The advisory covers path traversal, command injection, and memory corruption, with different vulnerabilities applying to each product.
The fixes are listed at 7.0.5, 7.1.7, and 7.2.3 for the corresponding release branches. Most of the listed vulnerabilities share those repair points, but their product coverage differs. CVE-2026-106079 has a narrower entry: it applies to Session Smart Router earlier than 7.0.5, with 7.0.5 and later listed as fixed. Its entry does not identify affected or fixed versions in the other branches.
The vendor advisory is the main reference for deciding which updates apply to a deployment. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-10-29. The available NVD information does not include descriptions or severity scores that would support a more detailed account of the individual flaws.
Technical details
Path traversal means software can mishandle a path in a way that crosses an intended directory boundary. Command injection means input can influence a command in an unintended way. Memory corruption means a program handles memory incorrectly. These are the weakness categories identified for this advisory, but there is no mapping here that ties a particular category to a particular CVE. Assigning an individual flaw to one of these categories would require more information.
The available technical detail does not identify the vulnerable functions, the specific coding mistakes, or the affected interfaces. It also does not establish attack prerequisites, such as whether an attacker needs an account, a particular permission, or access to a particular service. The weakness names alone cannot establish those conditions or the precise consequences of a successful attack.
CVE-2026-103401, CVE-2026-103402, CVE-2026-103403, and CVE-2026-103407 affect both Session Smart Router and Session Smart Conductor. CVE-2026-103406 is listed for Session Smart Conductor. CVE-2026-103408, CVE-2026-103409, CVE-2026-103410, and CVE-2026-103411 are listed for Session Smart Router. Those entries identify fixes at 7.0.5, 7.1.7, and 7.2.3 in their corresponding branches. CVE-2026-106079 is listed only for Session Smart Router earlier than 7.0.5.
CVSS is a standardized way to describe vulnerability severity using factors such as attack conditions and potential impact. No CVSS scores or CWE identifiers are available for these entries, so there is no supported numerical severity comparison or more specific weakness classification to make. As of the catalog check, none of these CVEs was listed in CISA KEV, the Known Exploited Vulnerabilities catalog.
Weakness types: Path traversal, Command injection, Memory corruption
Who is affected
Everyday users
For everyday users, the practical question is whether the organization providing their network connection runs an affected Session Smart Router or Session Smart Conductor release. The update work belongs with whoever administers that deployment. A user who does not manage these products can pass the advisory to the relevant IT team and ask whether its installed versions have been checked.
The advisory does not establish that an individual user's information was accessed or that a particular network experienced an attack. It identifies software versions that need attention. Keeping that distinction clear helps users ask a useful question: has the responsible team matched its installed product and release branch to the vendor's fixes?
Developers
Developers who work with environments containing Session Smart Router or Session Smart Conductor should coordinate with the team responsible for those products. The product-specific CVE coverage matters: a Session Smart Conductor installation does not have the same list of applicable vulnerabilities as a Session Smart Router installation.
The weakness categories are useful background, but they do not provide enough detail to reproduce a flaw or design a targeted regression test. Review the vendor advisory for any additional technical guidance, and check the applications and workflows that depend on the deployment after its software is updated.
Server and IT admins
Administrators should inventory Session Smart Router and Session Smart Conductor separately, recording each installed software version and release branch. For the entries with fixes across the listed branches, compare releases earlier than 7.0.5, earlier than 7.1.7, or earlier than 7.2.3 against the matching branch's fixed release. Treat these as branch-specific thresholds when planning the update.
Keep CVE-2026-106079 separate during that review. Its listed scope is Session Smart Router earlier than 7.0.5, and its stated fix is 7.0.5 and later. The absence of entries for other branches is not a basis for inventing additional affected ranges. Follow the update steps in the vendor's advisory, then verify the installed version on every affected instance.
What to do now
- Identify every Session Smart Router and Session Smart Conductor instance you administer, including its installed release branch.
- Check the device software version with the allowed CLI command, show version, and record the result for comparison with the vendor advisory.
- Match each product to its applicable CVEs. Pay particular attention to the Session Smart Conductor-only entry and the Session Smart Router-only entries.
- For the applicable release branch, use the listed fixed release of 7.0.5 and later, 7.1.7 and later, or 7.2.3 and later. Review CVE-2026-106079 against its separate Session Smart Router entry.
- Follow the update steps in the vendor's advisory for each affected installation.
- After updating, check the running software version again and confirm that the deployment's normal operations still work.
Check the device software version (CLI) · official docs
show versionIf you can't update yet
- Check the vendor advisory for guidance on restricting access to affected deployments while an update is pending.
- Check the vendor advisory for guidance on reducing internet exposure. Treat exposure reduction as a temporary measure alongside the update plan.
- Disable an affected feature only if the vendor advisory identifies it and recommends doing so.
How to confirm the fix
- Run show version after the update and confirm that the running release meets the fixed-version threshold for its branch.
- Check Session Smart Router and Session Smart Conductor independently so that an updated instance does not obscure another instance still awaiting a fix.
- For CVE-2026-106079, confirm the Session Smart Router installation against the listed fix of 7.0.5 and later.
- Confirm normal operation of the updated deployment and the applications or workflows that depend on it. Record the resulting software versions.
NVD scores and CISA KEV status
As of October 30, 2026, none of these CVEs is listed in the CISA Known Exploited Vulnerabilities catalog.
This advisory covers 10 CVEs, so check individual scores in the vendor advisory and on NVD.
Affected products and fixed versions 45 rows
| Product | Affected versions | Fixed version / action | CVE |
|---|---|---|---|
| Session Smart Router | earlier than 7.0.5 | 7.0.5 and later | CVE-2026-103401 |
| Session Smart Conductor | earlier than 7.0.5 | 7.0.5 and later | CVE-2026-103401 |
| Session Smart Router | earlier than 7.1.7 | 7.1.7 and later | CVE-2026-103401 |
| Session Smart Conductor | earlier than 7.1.7 | 7.1.7 and later | CVE-2026-103401 |
| Session Smart Router | earlier than 7.2.3 | 7.2.3 and later | CVE-2026-103401 |
| Session Smart Conductor | earlier than 7.2.3 | 7.2.3 and later | CVE-2026-103401 |
| Session Smart Router | earlier than 7.0.5 | 7.0.5 and later | CVE-2026-103402 |
| Session Smart Conductor | earlier than 7.0.5 | 7.0.5 and later | CVE-2026-103402 |
| Session Smart Router | earlier than 7.1.7 | 7.1.7 and later | CVE-2026-103402 |
| Session Smart Conductor | earlier than 7.1.7 | 7.1.7 and later | CVE-2026-103402 |
| Session Smart Router | earlier than 7.2.3 | 7.2.3 and later | CVE-2026-103402 |
| Session Smart Conductor | earlier than 7.2.3 | 7.2.3 and later | CVE-2026-103402 |
| Session Smart Router | earlier than 7.0.5 | 7.0.5 and later | CVE-2026-103403 |
| Session Smart Conductor | earlier than 7.0.5 | 7.0.5 and later | CVE-2026-103403 |
| Session Smart Router | earlier than 7.1.7 | 7.1.7 and later | CVE-2026-103403 |
| Session Smart Conductor | earlier than 7.1.7 | 7.1.7 and later | CVE-2026-103403 |
| Session Smart Router | earlier than 7.2.3 | 7.2.3 and later | CVE-2026-103403 |
| Session Smart Conductor | earlier than 7.2.3 | 7.2.3 and later | CVE-2026-103403 |
| Session Smart Conductor | earlier than 7.0.5 | 7.0.5 and later | CVE-2026-103406 |
| Session Smart Conductor | earlier than 7.1.7 | 7.1.7 and later | CVE-2026-103406 |
| Session Smart Conductor | earlier than 7.2.3 | 7.2.3 and later | CVE-2026-103406 |
| Session Smart Router | earlier than 7.0.5 | 7.0.5 and later | CVE-2026-103407 |
| Session Smart Conductor | earlier than 7.0.5 | 7.0.5 and later | CVE-2026-103407 |
| Session Smart Router | earlier than 7.1.7 | 7.1.7 and later | CVE-2026-103407 |
| Session Smart Conductor | earlier than 7.1.7 | 7.1.7 and later | CVE-2026-103407 |
Show 20 more rows
| Product | Affected versions | Fixed version / action | CVE |
|---|---|---|---|
| Session Smart Router | earlier than 7.2.3 | 7.2.3 and later | CVE-2026-103407 |
| Session Smart Conductor | earlier than 7.2.3 | 7.2.3 and later | CVE-2026-103407 |
| Session Smart Router | earlier than 7.0.5 | 7.0.5 and later | CVE-2026-103408 |
| Session Smart Router | earlier than 7.1.7 | 7.1.7 and later | CVE-2026-103408 |
| Session Smart Router | earlier than 7.2.3 | 7.2.3 and later | CVE-2026-103408 |
| Session Smart Router | earlier than 7.0.5 | 7.0.5 and later | CVE-2026-103409 |
| Session Smart Router | earlier than 7.1.7 | 7.1.7 and later | CVE-2026-103409 |
| Session Smart Router | earlier than 7.2.3 | 7.2.3 and later | CVE-2026-103409 |
| Session Smart Router | earlier than 7.0.5 | 7.0.5 and later | CVE-2026-103410 |
| Session Smart Router | earlier than 7.1.7 | 7.1.7 and later | CVE-2026-103410 |
| Session Smart Router | earlier than 7.2.3 | 7.2.3 and later | CVE-2026-103410 |
| Session Smart Router | earlier than 7.0.5 | 7.0.5 and later | CVE-2026-103411 |
| Session Smart Router | earlier than 7.1.7 | 7.1.7 and later | CVE-2026-103411 |
| Session Smart Router | earlier than 7.2.3 | 7.2.3 and later | CVE-2026-103411 |
| Session Smart Router | earlier than 7.0.5 | 7.0.5 and later | CVE-2026-106079 |
| Session Smart Conductor | earlier than 7.0.5 | 7.0.5 and later | CVE-2026-106079 |
| Session Smart Router | earlier than 7.1.7 | 7.1.7 and later | CVE-2026-106079 |
| Session Smart Conductor | earlier than 7.1.7 | 7.1.7 and later | CVE-2026-106079 |
| Session Smart Router | earlier than 7.2.3 | 7.2.3 and later | CVE-2026-106079 |
| Session Smart Conductor | earlier than 7.2.3 | 7.2.3 and later | CVE-2026-106079 |
The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.
Frequently asked questions
Do both products have the same vulnerabilities?
No. CVE-2026-103401, CVE-2026-103402, CVE-2026-103403, and CVE-2026-103407 apply to both products. CVE-2026-103406 is listed only for Session Smart Conductor. CVE-2026-103408, CVE-2026-103409, CVE-2026-103410, CVE-2026-103411, and CVE-2026-106079 are listed only for Session Smart Router.
Which software release contains the fixes?
The shared branch-specific repair points are 7.0.5, 7.1.7, and 7.2.3, with those versions and later listed as fixed in their corresponding branches. CVE-2026-106079 has a separate entry identifying Session Smart Router earlier than 7.0.5 as affected and 7.0.5 and later as fixed. Follow the update steps in the vendor's advisory for your installation.
Can I rank these vulnerabilities by severity?
No CVSS scores are available for these entries, and the technical descriptions do not establish individual attack prerequisites or impacts. Use the applicable product and version entries to identify required updates, and check the vendor advisory for further guidance.
References
- Juniper Networks advisory: https://supportportal.juniper.net/JSA112183
- NVD: CVE-2026-103401
- NVD: CVE-2026-103402
- NVD: CVE-2026-103403
- NVD: CVE-2026-103406
- NVD: CVE-2026-103407
- NVD: CVE-2026-103408
- NVD: CVE-2026-103409
- NVD: CVE-2026-103410
- NVD: CVE-2026-103411
- NVD: CVE-2026-106079
- CISA Known Exploited Vulnerabilities catalog
- Also reported by KISA (Korea Internet & Security Agency) on October 29, 2026: KISA advisory (Korean)
How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.