High priorityDisclosed

Advisory · CVE-2026-103407

Authenticated certificate and key file access on Juniper Session Smart routers and conductors

An authenticated REST user can read, overwrite, or delete arbitrary certificate and private-key files on Juniper Session Smart Router and Conductor. Juniper rates it 8.8.

Advisory published October 28, 2026Independent summary
Vendor
Juniper Networks
Product
Session Smart Router and Session Smart Conductor
Identifier / CWE
CVE-2026-103407
CWE-22
Action timing
Immediate
ELI5

Explain it like I’m five

The certificate API is supposed to stay inside its own folder, but a crafted path walks out of it. An authenticated user can then read or destroy any certificate or private key on the box.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Authenticated REST access

    An attacker holds credentials for an authenticated REST user.

  2. 02Path traversal

    A crafted path in the certificate and private-key REST API escapes the intended directory.

  3. 03Key files exposed

    The attacker reads, overwrites, or deletes arbitrary certificate and key files on the host filesystem.

What happened

Juniper disclosed Session Smart releases before 7.0.5, 7.1.0 through 7.1.6, and 7.2.0 through 7.2.2 as affected for Session Smart Router and Session Smart Conductor. An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API. Juniper rates it 8.8.

Certificate and private-key compromise on a network controller can outlive the patch itself: stolen keys can be reused elsewhere, so rotation belongs in the response plan, not just the upgrade.

What to do

  1. Inventory Session Smart Router and Conductor deployments.
  2. Upgrade to 7.0.5, 7.1.7, or 7.2.3 or later on the matching release line.
  3. Restrict REST API access to trusted administrators until patched.
  4. Review API logs for unusual certificate or key file access.
  5. Rotate certificates and private keys that may have been exposed.
  6. Confirm the deployed version after patching.

Management note

Key material is the long tail of this flaw. Patching closes the hole but does not un-expose anything already read, so plan rotation alongside the upgrade.