Live › vulnerability › CVE-2026-103402
Go to dashboardPCLI in Juniper Session Smart Router and Session Smart Conductor processes model cache files without verifying their authenticity. An attacker who can write to the model cache directory can run arbitrary code and escalate privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Teams running Juniper Session Smart Router or Session Smart Conductor. The flaw needs local write access to the PCLI model cache directory, so an attacker must already have a local account or foothold on the device. They can then run code and escalate privileges. Affected and fixed versions are not yet confirmed. Teams without these Juniper products can skip it.
No product ranges from the sources yet.
show system version on each Session Smart Router and Conductor and compare with the fixed releases in Juniper's bulletin for this CVE (not yet confirmed; possibly JSA112528)Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache files.
This page as .md · .json · in your agent: get_signal("CVE-2026-103402")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.