CVE-2026-103402
Awaiting Analysis
Awaiting Analysis - Queue
Insufficient Verification in Juniper Session Smart Router
Vulnerability report for CVE-2026-103402, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-28
Last updated on: 2026-10-28
Assigner: Juniper Networks, Inc.
Description
Description
An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache files.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Juniper Networks | Session Smart Router | 0 |
| Juniper Networks | Session Smart Router | 7.1.0 |
| Juniper Networks | Session Smart Router | 7.2.0 |
| Juniper Networks | Session Smart Conductor | 0 |
| Juniper Networks | Session Smart Conductor | 7.1.0 |
| Juniper Networks | Session Smart Conductor | 7.2.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-345 | The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. |
