{"id":"CVE-2026-103392","kind":"vulnerability","aliases":["CVE-2026-103392"],"related":[],"title":"Juniper Session Smart Router: oversized TCP SACK option corrupts session data","description":"An Out-of-Bounds Write vulnerability in the TCP header processing in Juniper Networks Session Smart Router allows an attacker to corrupt TCP payload data and potentially cause session desynchronization via a transit TCP packet with an oversized SACK option length.","summary":"A flaw in how Juniper Session Smart Router processes TCP headers lets an out-of-bounds write happen when a transit packet carries an oversized SACK option length. An attacker can corrupt TCP payload data and possibly desynchronize sessions passing through the device.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","juniper","network-appliance","session-smart-router"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-28T17:17:22+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","triaged_at":"2026-10-28T17:34:40+00:00","updated_at":"2026-10-28T17:34:40+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-28T17:34:40Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Juniper Session Smart Router: oversized TCP SACK option corrupts session data","impact":"medium","summary":"A flaw in how Juniper Session Smart Router processes TCP headers lets an out-of-bounds write happen when a transit packet carries an oversized SACK option length. An attacker can corrupt TCP payload data and possibly desynchronize sessions passing through the device.","category":"infrastructure","nicknames":[],"who_cares":["juniper","session-smart-router","network-appliance"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker corrupts TCP payload data and desynchronizes sessions","analyst_note":"Find the Juniper advisory (JSA) for CVE-2026-103392 to get affected and fixed versions and any mitigation.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Juniper Session Smart Router appliances that carry TCP traffic in transit. The sources do not name affected or fixed versions. Teams that do not run this appliance can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000548,"input_tokens":3313,"output_tokens":434,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103392':14A,17A '-2026':13A,16A 'allow':89C 'applianc':22B 'attack':57B,91C 'bound':43B,75C 'carri':50B 'caus':99C 'corrupt':9A,59B,93C 'cve':12A,15A 'data':11A,62B,96C 'desynchron':65B,101C 'devic':70B 'flaw':28B 'happen':45B 'header':37B,81C 'infrastructur':18B 'junip':1A,19B,31B,84C 'length':55B,112C 'let':38B 'network':21B,85C 'network-appli':20B 'option':8A,54B,111C 'out-of-bound':40B,72C 'overs':5A,52B,109C 'packet':49B,106C 'pass':67B 'payload':61B,95C 'possibl':64B 'potenti':98C 'process':35B,82C 'router':4A,26B,34B,88C 'sack':7A,53B,110C 'session':2A,10A,24B,32B,66B,86C,100C 'session-smart-rout':23B 'smart':3A,25B,33B,87C 'tcp':6A,36B,60B,80C,94C,105C 'transit':48B,104C 'via':102C 'vulner':77C 'write':44B,76C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Juniper Session Smart Router appliances that carry TCP traffic in transit. The sources do not name affected or fixed versions. Teams that do not run this appliance can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","cvss_by":"sirt@juniper.net","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103392","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103392","severity":null,"published_at":"2026-10-28T17:17:22+00:00","modified_at":"2026-10-28T17:17:22+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","fetched_at":"2026-10-28T17:34:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}