p PatchFirst

CVE-2026-106079

CVE-2026-106079 · Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YANG configuration.

CVSS 8.8 · High · EPSS 1.2% · Fix available

Published
Updated

Affected products and versions

  • session smart router

    Versions
    • ≥ 0, < 7.0.5: Affected (custom)
    • ≥ 7.1.0, < 7.1.7: Affected (custom)
    • ≥ 7.2.0, < 7.2.3: Affected (custom)

    Update to 7.0.5; Update to 7.1.7; Update to 7.2.3

  • session smart conductor

    Versions
    • ≥ 0, < 7.0.5: Affected (custom)
    • ≥ 7.1.0, < 7.1.7: Affected (custom)
    • ≥ 7.2.0, < 7.2.3: Affected (custom)

    Update to 7.0.5; Update to 7.1.7; Update to 7.2.3

Original sources

Check your server →