Skip to content
OpenAdvisories
High · 8.8 CVE-2026-103402 EUVD-2026-112219GHSA-fq6r-5gh8-h83j

Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation

Published Oct 28, 2026 · Updated Nov 6, 2026 · Assigned by juniper

Vendor: Juniper Networks Product: Session Smart Conductor Product: Session Smart Router Category: Network devices

Description

An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache files.

Affected products

VendorProductAffectedFixed
Juniper Networks Session Smart Router < 7.0.5, 7.1.0 – < 7.1.7, 7.2.0 – < 7.2.3 7.0.5
Juniper Networks Session Smart Conductor < 7.0.5, 7.1.0 – < 7.1.7, 7.2.0 – < 7.2.3 7.0.5

Advisories 2

References