CVE-2026-103404: Session Smart Conductor: Insecure file permissions cause unauthorized access to sensitive routing credentials

Published Oct 28, 2026

Updated

An Incorrect Permission Assignment for Critical Resource vulnerability in RoutingManager in Juniper Networks Session Smart Conductor allows a local user to access sensitive routing credentials via triggering processes that write to the /tmp directory.

Affected Software

1 affected component

Juniper Networks Session Smart Conductor

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Juniper Networks Session Smart Conductor to a version that resolves this vulnerability.
Fixed in 7.0.5
Upgrade
Upgrade Juniper Networks Session Smart Conductor to a version that resolves this vulnerability.
Fixed in 7.1.7
Upgrade
Upgrade Juniper Networks Session Smart Conductor to a version that resolves this vulnerability.
Fixed in 7.2.3

Event History

Oct 28, 2026

CVE Published

via MITRE·04:35 PM

Data Sourced

via MITRE·04:35 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Juniper Networks Session Smart Conductor deployments are affected where a local user can trigger processes that write to the /tmp directory. The issue permits that local user to access sensitive routing credentials.

What access does an attacker need to exploit it?

The vulnerability requires local access. An attacker must be able to trigger the relevant processes that write to /tmp; no privileges or user interaction are indicated in the provided data.

What is the potential impact?

Successful exploitation can disclose sensitive routing credentials. The supplied vector indicates no integrity or availability impact.