CVE-2026-106079: Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration

Published Oct 28, 2026

Updated

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YANG configuration.

Affected Software

2 affected components

Juniper Networks Session Smart Router

Juniper Networks Session Smart Conductor

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Juniper Networks Session Smart Router and Session Smart Conductor to a version that resolves this vulnerability.
Fixed in 7.0.5
Upgrade
Upgrade Juniper Networks Session Smart Router and Session Smart Conductor to a version that resolves this vulnerability.
Fixed in 7.1.7
Upgrade
Upgrade Juniper Networks Session Smart Router and Session Smart Conductor to a version that resolves this vulnerability.
Fixed in 7.2.3

Event History

Oct 28, 2026

CVE Published

via MITRE·04:37 PM

Data Sourced

via MITRE·04:37 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must already have config-write privileges in AccessManager. The issue affects Juniper Networks Session Smart Router and Session Smart Conductor when updating YANG configuration.

What level of access can exploitation provide?

Successful exploitation allows arbitrary command execution as root, resulting in full impact to confidentiality, integrity, and availability.