The vulnerability is an operating system command injection in the AccessManager component of Juniper Networks Session Smart Router and Session Smart Conductor. It allows an attacker to delete audit rules and then execute arbitrary shell commands, resulting in file deletion or other system changes. This flaw could compromise the confidentiality, integrity, and availability of the device.

Juniper Networks Session Smart Router and Session Smart Conductor are affected. Versions prior to 7.0.5 for Session Smart Router, prior to 7.1.7 for Session Smart Conductor, and prior to 7.2.3 for both are vulnerable.

With a CVSS score of 8.8 the vulnerability is considered high severity. Exploitability is possible once the attacker can use the audit‑rule deletion interface, which typically requires authentication to an admin interface. Because the EPSS score is not available, the exact exploitation probability is unknown, but the lack of a KEV listing indicates no widely documented public exploits yet. Nevertheless, the potential for remote command execution poses a serious risk.