Critical severity · published Jan 27, 2026
CVE-2025-21589
Session Smart Router, Session Smart Conductor, WAN Assurance Router: API Authentication Bypass vulnerability
9.8
CVSS
1.5%
EPSS
No
On KEV
Description
An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may allows a network-based attacker to bypass authentication and take administrative control of the device. This issue affects Session Smart Router:  * from 5.6.7 before 5.6.17,  * from 6.0 before 6.0.8 (affected from 6.0.8), * from 6.1 before 6.1.12-lts,  * from 6.2 before 6.2.8-lts,  * from 6.3 before 6.3.3-r2;  This issue affects Session Smart Conductor:  * from 5.6.7 before 5.6.17,  * from 6.0 before 6.0.8 (affected from 6.0.8), * from 6.1 before 6.1.12-lts,  * from 6.2 before 6.2.8-lts,  * from 6.3 before 6.3.3-r2;  This issue affects WAN Assurance Managed Routers:  * from 5.6.7 before 5.6.17,  * from 6.0 before 6.0.8 (affected from 6.0.8), * from 6.1 before 6.1.12-lts,  * from 6.2 before 6.2.8-lts,  * from 6.3 before 6.3.3-r2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Session Smart Conductor · Juniper Networks
5.6.7 before 5.6.17; 6.1 before 6.1.12-lts; 6.2 before 6.2.8-lts; 6.3 before 6.3.3-r2 · source: vendor
SS
Session Smart Router · Juniper Networks
5.6.7 before 5.6.17; 6.1 before 6.1.12-lts; 6.2 before 6.2.8-lts; 6.3 before 6.3.3-r2 · source: vendor
WA
WAN Assurance Managed Router · Juniper Networks
5.6.7 before 5.6.17; 6.1 before 6.1.12-lts; 6.2 before 6.2.8-lts; 6.3 before 6.3.3-r2 · source: vendor
Affected product
SS
Session Smart Conductor
Juniper Networks
More from Session Smart Conductor
9.8
CVE-2026-103406
Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.
8.8
CVE-2026-106079
Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration
8.8
CVE-2026-103407
Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management
8.8
CVE-2026-103403
Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules
8.8
CVE-2026-103402
Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation