Which versions of Juniper are affected by CVE-2025-21589?

A critical authentication bypass vulnerability in Juniper Networks Session Smart Router (CVE-2025-21589, CVSS 9.8) allows unauthenticated network attackers to gain full administrative control without…

How to fix or mitigate CVE-2025-21589?

Within 24 hours: Identify and inventory all Session Smart Router deployments in your environment and isolate affected devices from untrusted networks. Within 7 days: Implement emergency network segmentation to restrict administrative access to routers from trusted management networks only, enforce strict ingress/egress filtering, and establish continuous monitoring for suspicious authentication attempts. Within 30 days: Maintain vigilant watch for vendor patch release and prepare expedited deployment procedures; consider architecture changes to reduce reliance on vulnerable devices or evaluate replacement solutions if patching timeline is unacceptable.

Juniper CVE-2025-21589

Q: What is the CVSS score of CVE-2025-21589?

CVE-2025-21589 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-01-27 sirt@juniper.net

Authentication Bypass Juniper

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 15, 2026 - 15:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Jan 27, 2026 - 21:15 nvd

CRITICAL 9.8

DescriptionCVE.org

An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may allows a network-based attacker to bypass authentication and take administrative control of the device.

This issue affects Session Smart Router:

from 5.6.7 before 5.6.17,
from 6.0 before 6.0.8 (affected from 6.0.8),
from 6.1 before 6.1.12-lts,
from 6.2 before 6.2.8-lts,
from 6.3 before 6.3.3-r2;

This issue affects Session Smart Conductor:

from 5.6.7 before 5.6.17,
from 6.0 before 6.0.8 (affected from 6.0.8),
from 6.1 before 6.1.12-lts,
from 6.2 before 6.2.8-lts,
from 6.3 before 6.3.3-r2;

This issue affects WAN Assurance Managed Routers:

from 5.6.7 before 5.6.17,
from 6.0 before 6.0.8 (affected from 6.0.8),
from 6.1 before 6.1.12-lts,
from 6.2 before 6.2.8-lts,
from 6.3 before 6.3.3-r2.

AnalysisAI

Authentication bypass in Juniper Networks Session Smart Router and Conductor allows network-based attackers to gain administrative control without credentials. The vulnerability affects multiple versions of the routing platform used in enterprise SD-WAN deployments.

Technical ContextAI

CWE-288 vulnerability in Session Smart Router versions 5.6.7-6.3 and Session Smart Conductor. The alternate authentication channel bypasses the normal credential check for administrative access.