Product Affected

These issues affect all versions of Session Smart Router. These issues affect all versions of Session Smart Conductor.
Critical

CVSS: v3.1: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Problem

Multiple vulnerabilities have been resolved in Juniper Networks Session Smart Router and Session Smart Conductor 7.0.5, 7.1.7, and 7.2.3 as a result of extensive internal testing of the software.

 

These issues affect all versions of Session Smart Router and Session Smart Conductor before 7.0.5, 7.1.7, and 7.2.3.

 

Important security issues resolved include:

 

CVECVSSSummary
CVE-2026-1033905.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)Session Smart Router and Session Smart Conductor: A malformed HTTP URI causes a service crash during HTTP application identification
CVE-2026-1033915.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)Session Smart Router: An attacker-controlled TCP option causes an out-of-bounds write when using the TCP proxy feature
CVE-2026-1033924.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)Session Smart Router: A SACK option causes out-of-bounds memory access and TCP payload corruption when TCP sequence stitching is enabled
CVE-2026-1033934.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)Session Smart Router: An attacker can cause an out-of-bounds read during VRRP packet processing
CVE-2026-1033943.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates.
CVE-2026-1034005.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanup
CVE-2026-1034018.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root
CVE-2026-1034028.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation
CVE-2026-1034038.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules
CVE-2026-1034046.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)Session Smart Conductor: Insecure file permissions cause unauthorized access to sensitive routing credentials
CVE-2026-1034055.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N)Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting
CVE-2026-1034069.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.
CVE-2026-1034078.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management
CVE-2026-1034088.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options
CVE-2026-1034099.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed
CVE-2026-1034107.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection
CVE-2026-1034117.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing
CVE-2026-1060798.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration

 

Juniper SIRT is not aware of any malicious exploitation of these vulnerabilities.

These issues were found during internal product security testing or research.

Solution

The following software releases of Session Smart Router and Session Smart Conductor have been updated to resolve these specific issues:

 

  • 7.0.5 and all subsequent releases
  • 7.1.7 and all subsequent releases
  • 7.2.3 and all subsequent releases

 

Note: Juniper SIRT's policy is not to evaluate releases that are beyond End of Engineering (EOE) or End of Life (EOL).

Workaround

There are no known workarounds for all of these issues.

Refer to the specific CVE records for additional details on potential individual workarounds.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History

2026-10-28: Initial Publication

Related Information