Advisory · CVE-2026-103402
Unverified cache files give code execution on Juniper Session Smart routers and conductors
An attacker with write access to the model cache directory can get arbitrary code execution and privilege escalation on Juniper Session Smart Router and Conductor. Juniper rates it 8.8.
- Vendor
- Juniper Networks
- Product
- Session Smart Router and Session Smart Conductor
- Identifier / CWE
- CVE-2026-103402
CWE-345 - Action timing
- Immediate
Explain it like I’m five
The device trusts files left in its model cache drawer without checking who wrote them. Anyone who can slip a file into that drawer gets their code run.
- 01Cache write access
An attacker gains write access to the model cache directory.
- 02Unverified cache file
PCLI processes the cache file without verifying its authenticity.
- 03Code execution
The attacker executes arbitrary code and escalates privileges.
What happened
Juniper disclosed Session Smart releases before 7.0.5, 7.1.0 through 7.1.6, and 7.2.0 through 7.2.2 as affected for Session Smart Router and Session Smart Conductor. An Insufficient Verification of Data Authenticity vulnerability in PCLI allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache files. Juniper rates it 8.8.
Exploitation needs write access to the cache directory, so this is a privilege-escalation and lateral-movement flaw rather than a direct remote entry point, but on a network controller the step from cache write to code execution is a serious trust-boundary failure.
What to do
- Inventory Session Smart Router and Conductor deployments.
- Upgrade to 7.0.5, 7.1.7, or 7.2.3 or later on the matching release line.
- Audit who and what can write to the model cache directory.
- Review cache contents and system logs for unexpected or tampered files.
- Confirm the deployed version after patching.
Management note
Cache integrity is part of the device trust boundary. If anything else on the box can write to that directory, this flaw turns a foothold into full control.