High priorityDisclosed

Advisory · CVE-2026-103401

Unauthenticated file overwrite as root on Juniper Session Smart routers and conductors

A link-following flaw in unauthenticated web handlers lets a low-privileged user overwrite arbitrary files as root on Juniper Session Smart Router and Conductor. Juniper rates it 8.8.

Advisory published October 28, 2026Independent summary
Vendor
Juniper Networks
Product
Session Smart Router and Session Smart Conductor
Identifier / CWE
CVE-2026-103401
CWE-59
Action timing
Immediate
ELI5

Explain it like I’m five

The web server follows shortcuts without checking where they point, so a low-privileged user can point a shortcut at a system file and overwrite it as root.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Unauthenticated API request

    An attacker reaches the unauthenticated web server handlers.

  2. 02Link followed

    Improper link resolution lets the request follow a filesystem link to an arbitrary location.

  3. 03File overwritten as root

    The attacker overwrites arbitrary files with root privileges.

What happened

Juniper disclosed Session Smart releases before 7.0.5, 7.1.0 through 7.1.6, and 7.2.0 through 7.2.2 as affected for Session Smart Router and Session Smart Conductor. An Improper Link Resolution Before File Access vulnerability in the unauthenticated web server handlers allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints. Juniper rates it 8.8.

Juniper notes the flaw can be exploited on Mist-managed routers and on unmanaged routers that have not yet been onboarded to a Conductor, while routers already managed by Conductor are not affected.

What to do

  1. Inventory Session Smart Router and Conductor deployments, including Mist-managed and unmanaged routers.
  2. Upgrade to 7.0.5, 7.1.7, or 7.2.3 or later on the matching release line.
  3. Restrict access to the web and API handlers until patched.
  4. Check for unexpected file changes or planted links on affected hosts.
  5. Confirm the deployed version after patching.

Management note

Arbitrary file overwrite as root is a short step from full compromise, and the exposure split between managed and unmanaged routers makes inventory the first task, not just patching.