p PatchFirst

CVE-2026-103403

CVE-2026-103403 · Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of an audit rule.

CVSS 8.8 · High · EPSS 1.2% · Fix available

Published
Updated

Affected products and versions

  • session smart router

    Versions
    • ≥ 0, < 7.0.5: Affected (custom)
    • ≥ 7.1.0, < 7.1.7: Affected (custom)
    • ≥ 7.2.0, < 7.2.3: Affected (custom)

    Update to 7.0.5; Update to 7.1.7; Update to 7.2.3

  • session smart conductor

    Versions
    • ≥ 0, < 7.0.5: Affected (custom)
    • ≥ 7.1.0, < 7.1.7: Affected (custom)
    • ≥ 7.2.0, < 7.2.3: Affected (custom)

    Update to 7.0.5; Update to 7.1.7; Update to 7.2.3

Original sources

Check your server →