Edge devices sit where attackers can reach them and defenders often can’t see them. On October 28, 2026, two vendors shipped fixes for flaws that hand an unauthenticated attacker root on exactly that kind of gear.
Juniper Session Smart Router and Conductor (JSA112183)
Juniper’s out-of-cycle bulletin JSA112183 fixes 18 internally discovered CVEs in Session Smart Router (SSR) and Session Smart Conductor, its SD-WAN routing platform. Two are rated CVSS 9.8:
- CVE-2026-103409 (Session Smart Router): missing authentication on an insecure endpoint that runs as root. An unauthenticated network attacker can gain administrative privileges by passing crafted URL parameters. The catch: it can only be exploited before the device is onboarded to Mist or Conductor. That makes freshly staged or half-deployed routers the risk.
- CVE-2026-103406 (Session Smart Conductor): an OS command injection in the AutomatedProvisioner that lets a remote attacker run commands as root through a crafted salt minion ID.
All versions before 7.0.5, 7.1.x before 7.1.7, and 7.2.x before 7.2.3 are affected. Juniper lists no workarounds and says it is not aware of malicious exploitation. One upgrade per product closes all 18 CVEs.
Sophos UTM: pre-auth root through the email proxy (CVE-2026-118633)
Sophos published CVE-2026-118633 the same day: a path traversal in Sophos UTM that lets an unauthenticated remote attacker execute commands as root after winning a race condition by sustaining repeated attacks for a few minutes. It’s reachable only when the email proxy is used with scanning enabled.
Sophos scores it CVSS 4.0 9.2 (CVSS 3.1 8.1) and lists all UTM versions as affected; the CVE record names SG UTM 9.724 and earlier. The complication is that Sophos UTM reached end of life on June 30, 2026, so the fix doesn’t arrive automatically. Sophos says urgent customer action is required: update to 9.724, then install the manual patch from KBA-000049692, or move to a supported Sophos Firewall. The bug was reported through Sophos’ bug bounty program by Sam Pizzey. Sophos does not report exploitation, and the CVE was not in CISA’s KEV catalog as of October 28.
Why these matter together
Both bugs give root on devices at the network perimeter, and both have a twist that makes them easy to miss: a Juniper router is only vulnerable in its pre-onboarding window, and the Sophos fix only reaches customers who go looking for it. This month has already shown how quickly perimeter bugs get chained. A reported campaign used PHP2Shell plus the Linux Fragnesia exploit to root two dozen firewalls.
What to do
- Inventory every Juniper SSR and Conductor and upgrade to 7.0.5, 7.1.7, or 7.2.3 or later. Do Conductors first, then any router not yet onboarded.
- Keep SSR and Conductor management interfaces off untrusted networks.
- Find every Sophos UTM acting as an SMTP gateway with email scanning, install KBA-000049692, and plan the migration off end-of-life UTM.
- If you can’t patch UTM today, consider disabling email proxy scanning or blocking external access to it until you can, and watch logs for sustained repeated requests.
Track these and other edge-device CVEs on our security index.
