CVE-2026-103403: Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules

Published Oct 28, 2026

Updated

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of an audit rule.

Affected Software

2 affected components

Juniper Networks Session Smart Router

Juniper Networks Session Smart Conductor

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Juniper Networks Session Smart Router and Session Smart Conductor to a version that resolves this vulnerability.
Fixed in 7.0.5
Upgrade
Upgrade Juniper Networks Session Smart Router and Session Smart Conductor to a version that resolves this vulnerability.
Fixed in 7.1.7
Upgrade
Upgrade Juniper Networks Session Smart Router and Session Smart Conductor to a version that resolves this vulnerability.
Fixed in 7.2.3

Event History

Oct 28, 2026

CVE Published

via MITRE·04:35 PM

Data Sourced

via MITRE·04:35 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require authentication or user interaction?

The vulnerability requires low-level privileges (PR:L) but does not require user interaction (UI:N). It is remotely reachable over the network (AV:N) with low attack complexity (AC:L).

What is the potential impact after successful exploitation?

A successful attacker can delete arbitrary files and execute arbitrary commands through deletion of an audit rule. The reported impact includes high confidentiality, integrity, and availability effects.