CVE-2026-103405: Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting

Published Oct 28, 2026

Updated

An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the web server in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to inject arbitrary HTTP headers via unsanitized request body parameters.

Affected Software

2 affected components

Juniper Networks Session Smart Router

Juniper Networks Session Smart Conductor

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Juniper Networks Session Smart Router and Session Smart Conductor to a version that resolves this vulnerability.
Fixed in 7.0.5
Upgrade
Upgrade Juniper Networks Session Smart Router and Session Smart Conductor to a version that resolves this vulnerability.
Fixed in 7.1.7
Upgrade
Upgrade Juniper Networks Session Smart Router and Session Smart Conductor to a version that resolves this vulnerability.
Fixed in 7.2.3

Event History

Oct 28, 2026

CVE Published

via MITRE·04:35 PM

Data Sourced

via MITRE·04:35 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The issue is remotely exploitable over the network and does not require privileges or user interaction. An attacker can use unsanitized request body parameters to inject arbitrary HTTP headers.

What is the potential impact?

Successful exploitation can alter HTTP response headers. The provided severity vector indicates an integrity impact and a scope change, with no stated confidentiality or availability impact.