CERT-FR flags 18 vulnerabilities in Juniper Session Smart Router and Conductor, including remote code execution
CERT-FR published advisory CERTFR-2026-AVI-1414 on 29 October 2026 about multiple vulnerabilities in Juniper Networks Session Smart Router and Session Smart Conductor. According to the advisory, some of the flaws allow an attacker to achieve remote arbitrary code execution, privilege escalation and remote denial of service. It also lists impacts on data integrity and confidentiality and a security policy bypass. The advisory relays Juniper bulletin JSA112183 of 28 October 2026, which covers internally discovered vulnerabilities, and references 18 CVEs. It reports no exploitation, no threat actors and no technical attack details.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1414 covers 18 CVEs (CVE-2026-103390 to CVE-2026-103394, CVE-2026-103400 to CVE-2026-103411 and CVE-2026-106079) in Juniper Session Smart Router and Session Smart Conductor. Taken together, the flaws allow remote arbitrary code execution, privilege escalation, remote denial of service, loss of data integrity and confidentiality, and a security policy bypass. The most severe impact listed is remote code execution, but the advisory does not map impacts to individual CVEs. It also gives no attack vector, authentication requirements or CVSS scores. Affected: Router and Conductor before 7.0.5, before 7.1.7 and before 7.2.3. Fixed: 7.0.5, 7.1.7 or 7.2.3, depending on the branch.
Como funciona
The articles do not describe how the vulnerable processes work. They do not say what input or event reaches which component, or at which step it fails. The advisory only lists the resulting impacts, such as remote code execution and remote denial of service, without technical detail. Juniper's bulletin JSA112183 may hold more, but it is not reproduced in the sources.
Por que é vulnerável
The root causes are not stated. The advisory gives no vulnerability classes (such as a missing check or memory corruption) for any of the 18 CVEs. It only says the fixes are in Session Smart Router and Conductor 7.0.5, 7.1.7 and 7.2.3, and does not explain what they change.
Como foi descoberta
According to the advisory, Juniper bulletin JSA112183 of 28 October 2026 covers vulnerabilities that Juniper discovered internally. CERT-FR relayed it on 29 October 2026. The advisory reports no exploitation, no threat actors and no technical attack details. The articles do not say how or by whom the flaws were found beyond the internal discovery, nor when they were reported.
Explicação gerada por IA a partir da matéria e dos artigos, em 30/10/2026 14:26.
Detalhes técnicos
- Impacts: remote code execution, privilege escalation, remote denial of service, breach of data integrity and confidentiality, security policy bypass.
- Affected: Session Smart Conductor and Session Smart Router before 7.0.5, before 7.1.7 and before 7.2.3.
- CVEs: CVE-2026-103390 to CVE-2026-103394, CVE-2026-103400 to CVE-2026-103411, and CVE-2026-106079.
- The advisory does not map individual CVEs to impacts and gives no attack vector, authentication requirements, CVSS scores or exploitation status.
Remediação
- Apply the fixed releases (7.0.5, 7.1.7 or 7.2.3, depending on the branch in use) as described in Juniper bulletin JSA112183 of 28 October 2026.
Linha do tempo
-
CERT-FR flags 18 vulnerabilities in Juniper Session Smart Router and Conductor, including remote code execution
ler a análise desta fonte ocultar
CERT-FR published advisory CERTFR-2026-AVI-1414 on 29 October 2026 about multiple vulnerabilities in Juniper Networks Session Smart Router and Session Smart Conductor. According to the advisory, some of the flaws allow an attacker to achieve remote arbitrary code execution, privilege escalation and remote denial of service. It also lists impacts on data integrity and confidentiality and a security policy bypass. The advisory relays Juniper bulletin JSA112183 of 28 October 2026, which covers internally discovered vulnerabilities, and references 18 CVEs. It reports no exploitation, no threat actors and no technical attack details.
Technical Details
- Impacts: remote code execution, privilege escalation, remote denial of service, breach of data integrity and confidentiality, security policy bypass.
- Affected: Session Smart Conductor and Session Smart Router before 7.0.5, before 7.1.7 and before 7.2.3.
- CVEs: CVE-2026-103390 to CVE-2026-103394, CVE-2026-103400 to CVE-2026-103411, and CVE-2026-106079.
- The advisory does not map individual CVEs to impacts and gives no attack vector, authentication requirements, CVSS scores or exploitation status.
Remediation
- Apply the fixed releases (7.0.5, 7.1.7 or 7.2.3, depending on the branch in use) as described in Juniper bulletin JSA112183 of 28 October 2026.