{"id":"CVE-2026-103409","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-103409","generatedAt":"2026-11-04T11:56:50.274Z","title":"A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running…","description":"A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root.\n\nNote that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor.","published":"2026-10-28T17:17:28.000Z","lastModified":"2026-10-28T17:17:28.000Z","status":"Awaiting Analysis","sourceIdentifier":"sirt@juniper.net","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-306"],"affected":[],"epss":{"score":0.00347,"percentile":0.28395,"date":"2026-11-03","history":[{"date":"2026-10-29","score":0.00347,"percentile":0.28301}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.35%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-28T17:17:28.000Z","detail":{"score":"9.8","severity":"CRITICAL","publishedAt":"2026-10-28T17:17:27.840Z"},"summary":"New CVE, critical severity (CVSS 9.8)."}],"references":[{"url":"https://supportportal.juniper.net/JSA112183","source":"sirt@juniper.net"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-103409","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}