8.8
HighCVSS 3.1 · from juniper
CVE-2026-106079
Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration
Session Smart Router · OS command injection · CWE-78AffectedSession Smart Router, Session Smart Conductor
FixUpdate to 7.0.5, 7.1.7, 7.2.3 or newer
PublishedOct 28, 16:37 · juniper
ScoredOct 28 · 8.8 · juniper
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YANG configuration.
From juniper
Affected and fixed versions
ProductAffectedFixed inSession Smart Routerbefore 7.0.57.0.5Session Smart Router7.1.0 – before 7.1.77.1.7Session Smart Router7.2.0 – before 7.2.37.2.3Session Smart Conductorbefore 7.0.57.0.5Session Smart Conductor7.1.0 – before 7.1.77.1.7Session Smart Conductor7.2.0 – before 7.2.37.2.3
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known