Juniper Patches 18 Flaws Including Unauthenticated Command Execution
Juniper Networks patched 18 vulnerabilities in Session Smart Router and Session Smart Conductor. The fixes include two critical flaws allowing unauthenticated arbitrary command execution and privilege escalation. Juniper found the bugs internally, says it is not aware of exploitation in the wild, and customers should apply the updates.
What happened
Juniper Networks released patches for 18 vulnerabilities in Session Smart Router and Session Smart Conductor. The package includes two critical flaws allowing unauthenticated arbitrary command execution and privilege escalation.
Why it matters
The flaws affect network equipment used to route and manage traffic. Unauthenticated command execution could give an attacker control of the device. Juniper says it is not aware of active exploitation.
What to do
Apply Juniper's updates to Session Smart Router and Session Smart Conductor and review the vendor's official advisories.
For the technical team
- Exploitation
- No known exploitation in the wild, according to Juniper, as reported by SecurityWeek. The bugs were discovered internally by the vendor.
- Fix
- Patches released by Juniper. Fixed versions not detailed in the source; check the vendor's official advisories.
- Vector
- Session Smart Router and Session Smart Conductor. Two critical flaws: unauthenticated arbitrary command execution and privilege escalation. High-severity flaws cover arbitrary file read, write and deletion, code execution, command execution, privilege escalation, information disclosure, and denial of service (DoS).
- More details
- In a separate advisory on the PHP2Shell vulnerabilities, Juniper noted that CVE-2026-109618 affects Junos OS, but not in an exploitable way. The company investigated roughly a dozen other products and found none to be vulnerable.
Timeline
Juniper Networks advisory covers critical flaws allowing code execution, authorization bypass, and privilege escalation.
