Juniper’s SSR Fixes Depend on the Device’s Management State
Juniper’s 28 October security bulletin identifies 18 vulnerabilities across Session Smart Router and Session Smart Conductor, including two rated 9.8. The fixes were announced on 16 October. An administrative-access flaw in the router is exploitable only before onboarding to Mist or Conductor; the other records have their own product, access and feature conditions.
The disclosed bulletin, JSA112183, identifies corrected releases starting at 7.0.5, 7.1.7 and 7.2.3. Juniper SIRT says it is not aware of malicious exploitation and attributes the findings to internal testing or research. That is its stated visibility, rather than evidence that every installation has been examined.
The patch came before the technical disclosure
The 16 October advance notification named those three releases and asked customers to upgrade before the planned 28 October disclosure. Its own last-updated date remains 16 October. The later bulletin supplies the individual mechanisms and conditions.
The advance notice includes Conductor-managed and Mist-managed environments, with a repository route for disconnected Conductor deployments. The three version numbers are the vendor’s fixed starting points for the listed branches. Juniper SIRT says it does not evaluate releases beyond End of Engineering or End of Life. Choose a currently supported, applicable release and verify the running software; a downloaded image or booked maintenance window is not an installation receipt.
Two critical issues, with different exposure boundaries
CVE-2026-103406 concerns Conductor’s AutomatedProvisioner. Its primary record describes a malicious Salt minion identifier reaching operating-system command execution as root. The vendor rates it as a network attack requiring neither credentials nor user interaction. This is a management-system issue, so an inventory limited to forwarding routers would miss an important part of the response.
CVE-2026-103409 concerns a router endpoint that can grant administrative privileges without authentication. The primary record adds the decisive condition: exploitation is possible before onboarding to Mist or Conductor and is no longer possible through this flaw once onboarding has completed. Record that actual state for each device, including equipment staged for deployment. Do not extend this exception to the other 17 records.
What the 18 records actually cover
The following list keeps the vendor’s CVSS 3.1 scores alongside the affected product and material conditions. Router means Session Smart Router; Conductor means Session Smart Conductor. These are separate flaws, not a demonstrated attack chain.
- CVE-2026-103390. Router and Conductor. CVSS 3.1: 5.3. A crafted HTTP request can crash HTTP application identification through the HttpParser component. No account is required in the vendor vector.
- CVE-2026-103391. Router. CVSS 3.1: 5.3. A malformed TCP option in transit traffic can corrupt forwarded data in the TCP proxy or optimisation path; the narrative also allows a possible data-plane crash.
- CVE-2026-103392. Router. CVSS 3.1: 4.8. An oversized selective-acknowledgement option can corrupt TCP payloads and disrupt session synchronisation. The bulletin identifies TCP sequence stitching as the relevant feature.
- CVE-2026-103393. Router. CVSS 3.1: 4.3. A layer-two neighbour can use a malformed VRRPv3 advertisement to expose stale memory or cause a system fault, according to the narrative.
- CVE-2026-103394. Router. CVSS 3.1: 3.7. Security-policy assignment can use incorrect encryption keys. The primary narrative describes possible traffic decryption or denial of service.
- CVE-2026-103400. Router and Conductor. CVSS 3.1: 5.5. Local access, specially named directories and a service restart can lead the ember cleanup process to unmount filesystems or interrupt service.
- CVE-2026-103401. Router and Conductor. CVSS 3.1: 8.8. The record describes a local unprivileged user overwriting files as root through unauthenticated handlers. For routers, it includes Mist-managed and not-yet-Conductor-managed devices, while excluding routers already managed by Conductor.
- CVE-2026-103402. Router and Conductor. CVSS 3.1: 8.8. Write access to the model-cache directory can let unverified cache data execute code and elevate privileges through PCLI.
- CVE-2026-103403. Router and Conductor. CVSS 3.1: 8.8. Deleting an audit rule can trigger file deletion or command execution through AccessManager. The vendor vector requires low privileges.
- CVE-2026-103404. Conductor. CVSS 3.1: 6.8. The narrative describes a local user reaching routing credentials through temporary files written by RoutingManager; the scoring vector instead labels the attack as network-based.
- CVE-2026-103405. Router and Conductor. CVSS 3.1: 5.8. Unfiltered request-body data can inject HTTP headers, allowing response splitting. The vector requires neither an account nor user action.
- CVE-2026-103406. Conductor. CVSS 3.1: 9.8. AutomatedProvisioner key management can accept a malicious Salt minion identifier and run commands as root without prior authentication.
- CVE-2026-103407. Router and Conductor. CVSS 3.1: 8.8. An authenticated REST user can cross certificate and private-key path boundaries to read, replace or delete files.
- CVE-2026-103408. Router. CVSS 3.1: 8.8. An unauthenticated attacker on the local network can exploit a DHCP-client buffer overflow with a malicious reply and achieve code execution.
- CVE-2026-103409. Router. CVSS 3.1: 9.8. An unauthenticated internal endpoint can grant administrative privileges before the device is onboarded to Mist or Conductor. The vendor says this path is no longer exploitable after that onboarding.
- CVE-2026-103410. Router. CVSS 3.1: 7.5. A remote unauthenticated attacker can interrupt the DPI certificate scanner with a malicious TLS server certificate.
- CVE-2026-103411. Router. CVSS 3.1: 7.1. A malicious DHCP reply from the local network can disclose information and crash a service through an integer-underflow issue.
- CVE-2026-106079. Router and Conductor. CVSS 3.1: 8.8. An attacker who already has configuration-write privileges can reach root command execution through the YANG configuration in AccessManager.
Some primary narratives and score vectors differ in scope. For example, the routing-credential record describes a local user but carries a network attack vector; the incorrect-key record describes possible decryption while its vector assigns no confidentiality impact. Preserve those distinctions when scoping an investigation. A score alone cannot settle what occurred on a particular device.
Check the Conductor route before the maintenance window
The current upgrade considerations retain a specific transitional step: a Conductor on 6.3.4 or earlier must first move through 6.3.5 to 6.3.7 before entering a 7.x line. Routers do not require that transitional step. The starting version of the controller and the versions of its routers are separate facts.
The documentation also warns that older installers need updating before a pre-6.3.0 system is upgraded, because failing to do so can affect rollback. Some cloud environments cannot perform disk changes required by certain routes. For deployments using the HA Sync Redundancy Plugin with 7.0.1, the guide identifies a plugin issue and recommends a 7.2.x route with a bond control interface. After installing or upgrading to 7.1.3, a downgrade to software without Configuration Integrity is unsupported, while rollback to the previously installed version remains supported. Establish the supported path and recovery procedure for the actual deployment rather than assuming every component can follow the same jump.
Separate exposure, deployment and recovery
Juniper lists no known workaround covering the bundle, and the checked individual records likewise provide no known workaround. Network reachability, onboarding, local access, write permissions, DHCP adjacency and enabled traffic-processing features still matter when prioritising affected systems. They do not replace the applicable correction.
BlackTree recommends keeping three receipts: the device’s initial version and relevant exposure state; the verified running replacement and maintenance result; and any investigation of access before the change. Give the Conductor, staged routers and deployed routers named owners. Preserve relevant authentication, management and configuration records before routine rotation removes them. A completed upgrade resolves a maintenance task; it does not by itself establish whether earlier access occurred.
