Juniper patches a flaw that hands root on the Session Smart Router before onboarding

On October 28, 2026, Juniper fixed CVE-2026-103409, a missing-authentication flaw (CVSS 9.8) that gives an unauthenticated network attacker root privileges on the Session Smart Router until the device is onboarded to Mist or Conductor. Upgrade to 7.0.5, 7.1.7, or 7.2.3 and onboard new boxes immediately, because the provisioning window is the exposed surface.