Vulnerabilities · 5h ago
The Netherlands’ NCSC reported on October 30 that Juniper had fixed 18 vulnerabilities across Session Smart Router and Session Smart Conductor, including critical flaws. The issues affect different components and range from unauthenticated network access to local-only vulnerabilities.
One critical Conductor flaw is in AutomatedProvisioner: a specially crafted Salt minion ID can trigger remote command execution as root without authentication. Other flaws include an authentication bypass. A Conductor compromise could therefore expose the management system itself, not just an individual forwarding router.
If Conductor manages routers in your network, its compromise could affect managed network operations; the advisory does not establish active exploitation or how far an intrusion could spread.
CVEs in this update
18 CVEs
Across Session Smart Conductor, Session Smart Router.
2 critical · 8 high · 7 medium · 1 low
0 in CISA KEV · 0 with EPSS above 1%
Highest severity: CVE-2026-103406 · 9.8 CRITICAL
Showing the top 10 by KEV, EPSS, and severity.
2 sources covering this story
Kwetsbaarheden verholpen in Juniper Networks Session Smart Router en Session Smart Conductor
Juniper heeft meerdere kwetsbaarheden verholpen in Juniper Networks Session Smart Router en Session Smart Conductor.
Aggiornamenti di sicurezza per prodotti Juniper Networks
Juniper Networks ha rilasciato aggiornamenti di sicurezza che sanano 18 vulnerabilità, di cui 2 con gravità "critica" e 8 con gravità "alta", nei prodotti Session Smart Router e Session Smart Conductor, soluzioni dedicate rispettivamente al routing e alla relativa gestione.
Part of the PlainSec briefing for 2026-10-30