CVE-2026-103403
Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules
Juniper Networks Session Smart RouterNetwork & edge
CVSS
8.8HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 7.0.5Session Smart RouterCVE List
- 7.1.7Session Smart RouterCVE List
- 7.2.3Session Smart RouterCVE List
- 7.0.5Session Smart ConductorCVE List
- 7.1.7Session Smart ConductorCVE List
- 7.2.3Session Smart ConductorCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of an audit rule.
Text from CVE List
Affected versions 6
- Session Smart Routeraffected: all versions before 7.0.5CVE List
- Session Smart Routeraffected: 7.1.0 before 7.1.7CVE List
- Session Smart Routeraffected: 7.2.0 before 7.2.3CVE List
- Session Smart Conductoraffected: all versions before 7.0.5CVE List
- Session Smart Conductoraffected: 7.1.0 before 7.1.7CVE List
- Session Smart Conductoraffected: 7.2.0 before 7.2.3CVE List