Juniper Session Smart Updates Fix 18 Security Flaws
Tech GuruQuick Answer
Juniper JSA112183 fixes 18 vulnerabilities in Session Smart Router and Conductor. Inventory exact branches and management exposure, update to 7.0.5, 7.1.7, or 7.2.3 as applicable, validate routing and administration, review exposed systems where warranted, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Session Smart Routers and Conductors, exact software branches, management and provisioning exposure, TCP proxy, DHCP, VRRP, PKI and audit features, owners, HA pairs, and maintenance windows. Match each device role and feature to the individual CVE record; do not assume every Router or Conductor is exposed to every flaw, and do not infer compromise from severity alone. Install Juniper's fixed maintenance release for the deployed branch: 7.0.5, 7.1.7, or 7.2.3. Restrict management and provisioning paths while rollout is pending. Confirm the running release, test control-plane access, routing, HA, DHCP, PKI and policy workflows, review relevant system and administration logs on exposed devices, and retain software and change evidence.
Last verified: 2026-10-29 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Juniper Session Smart Router and Session Smart Conductor |
|---|---|
| Advisory | JSA112183 |
| CVEs | CVE-2026-103390, CVE-2026-103391, CVE-2026-103392, CVE-2026-103393, CVE-2026-103394, CVE-2026-103400, CVE-2026-103401, CVE-2026-103402, CVE-2026-103403, CVE-2026-103404, CVE-2026-103405, CVE-2026-103406, CVE-2026-103407, CVE-2026-103408, CVE-2026-103409, CVE-2026-103410, CVE-2026-103411, CVE-2026-106079 |
| Authoritative release date | 2026-10-28 16:33:16.471 UTC |
| Authority revision date | 2026-10-29 01:52:04.374 UTC |
| Affected versions | Session Smart Router and Conductor releases before 7.0.5, 7.1.7, and 7.2.3 as identified per CVE; some issues affect only Router or only Conductor. |
| Fixed version | Juniper Session Smart 7.0.5, 7.1.7, or 7.2.3 on the corresponding maintained branch |
| CVSS base score | 3.7-9.8 (CVSS v3.1) |
| CVSS severity | Low to Critical |
| Exploitation status | Juniper describes the issues as internally discovered and does not state that they are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Juniper published JSA112183 with 18 internally discovered vulnerabilities, including unauthenticated command execution, authentication bypass, file access, privilege escalation, memory-safety faults, and denial of service.
What To Validate Now
- Inventory. Inventory Session Smart Routers and Conductors, exact software branches, management and provisioning exposure, TCP proxy, DHCP, VRRP, PKI and audit features, owners, HA pairs, and maintenance windows.
- Establish applicability. Match each device role and feature to the individual CVE record; do not assume every Router or Conductor is exposed to every flaw, and do not infer compromise from severity alone.
- Remediate. Install Juniper's fixed maintenance release for the deployed branch: 7.0.5, 7.1.7, or 7.2.3. Restrict management and provisioning paths while rollout is pending.
- Validate. Confirm the running release, test control-plane access, routing, HA, DHCP, PKI and policy workflows, review relevant system and administration logs on exposed devices, and retain software and change evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The batch combines unauthenticated network paths with authenticated and local paths. Network updates can interrupt routing and orchestration, so stage failover and rollback without delaying exposure reduction.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
