CVE-2026-103394: Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates.

Published Oct 28, 2026

Updated

An Improper Initialization vulnerability in the SSR software in Juniper Networks Session Smart Router allows an attacker to decrypt traffic or cause a denial of service via security policy assignment.

Affected Software

1 affected component

Juniper Networks Session Smart Router

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Juniper Networks Session Smart Router to a version that resolves this vulnerability.
Fixed in 7.0.5
Upgrade
Upgrade Juniper Networks Session Smart Router to a version that resolves this vulnerability.
Fixed in 7.1.7
Upgrade
Upgrade Juniper Networks Session Smart Router to a version that resolves this vulnerability.
Fixed in 7.2.3

Event History

Oct 28, 2026

CVE Published

via MITRE·04:34 PM

Data Sourced

via MITRE·04:34 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The CVSS vector indicates the attacker must be able to reach the affected router over the network. No prior privileges or user interaction are required, but exploitation has high attack complexity and occurs through security policy assignment.

What is the expected operational impact?

Successful exploitation may allow an attacker to decrypt traffic or cause a denial of service. The CVSS assessment rates the availability impact as low and does not identify an integrity impact.

CVE-2026-103394: Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates.

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the expected operational impact?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the expected operational impact?