CVE-2026-103402: Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation
Published Oct 28, 2026
·Updated
An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache files.
Affected Software
2 affected components
Juniper Networks Session Smart Router
Juniper Networks Session Smart Conductor
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Networks Session Smart Router and Session Smart Conductorto a version that resolves this vulnerability.Fixed in 7.0.5 - Upgrade
Upgrade
Juniper Networks Session Smart Router and Session Smart Conductorto a version that resolves this vulnerability.Fixed in 7.1.7 - Upgrade
Upgrade
Juniper Networks Session Smart Router and Session Smart Conductorto a version that resolves this vulnerability.Fixed in 7.2.3
Event History
Oct 28, 2026
CVE Published
via MITRE·04:34 PM
Data Sourced
via MITRE·04:34 PM
RemedyDescriptionSeverityWeakness