CVE-2026-103409: Insecure root-level HTTP endpoint (pre-onboarding)

Executive Summary & Technical Impact

A missing-authentication flaw lets an unauthenticated network attacker obtain administrative privileges on a Juniper Session Smart Router by passing crafted URL parameters to an insecure endpoint running as root. It is only exploitable before the device is onboarded to Mist or Conductor.

Tracked under CVE-2026-103409 (CWE-306 (Missing Authentication for Critical Function)), this vulnerability affects Session Smart Router before 7.0.5, 7.1.x before 7.1.7, 7.2.x before 7.2.3 (only before onboarding to Mist/Conductor) and carries a severity score of 9.8 (CRITICAL). Engineering and security operations teams running Session Smart Router should prioritize upgrading to 7.0.5, 7.1.7, 7.2.3 and later.

Remediation & Patch Guidance

1. Upgrade Session Smart Router to 7.0.5, 7.1.7, 7.2.3, or later.
2. Prioritize routers that are staged but not yet onboarded to Mist/Conductor.
3. Keep management interfaces off untrusted networks.

Frequently Asked Questions (CVE-2026-103409)

What versions are affected by CVE-2026-103409?

CVE-2026-103409 affects Session Smart Router before 7.0.5, 7.1.x before 7.1.7, 7.2.x before 7.2.3 (only before onboarding to Mist/Conductor) in Session Smart Router (Insecure root-level HTTP endpoint (pre-onboarding)).

How do I patch or remediate CVE-2026-103409?

Upgrade affected deployments to 7.0.5, 7.1.7, 7.2.3 and later and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-103409?

CVE-2026-103409 is rated CRITICAL with a CVSS score of 9.8 (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).