---
id: "CVE-2026-103402"
kind: "vulnerability"
aliases: ["CVE-2026-103402"]
title: "Juniper Session Smart Router: unverified cache files let local users run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "juniper", "network-appliance", "session-smart-conductor", "session-smart-router"]
not_affected_if: ["cache-directory-not-writable-by-others", "no-juniper-ssr", "no-local-access"]
published_at: "2026-10-28T17:17:24+00:00"
first_seen_at: "2026-10-28T17:34:08+00:00"
updated_at: "2026-10-28T17:38:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103402", "first_seen_at": "2026-10-28T17:34:08+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-28T17:38:26+00:00"}]
---

# Juniper Session Smart Router: unverified cache files let local users run code

PCLI in Juniper Session Smart Router and Session Smart Conductor processes model cache files without verifying their authenticity. An attacker who can write to the model cache directory can run arbitrary code and escalate privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Run 'show system version' on each Session Smart Router and Conductor and compare with the fixed releases in Juniper's bulletin for this CVE (not yet confirmed; possibly JSA112528). Check which local accounts can write to the PCLI model cache directory (path not confirmed).

## Timeline

- 2026-10-28T17:34:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103402
- 2026-10-28T17:38:26+00:00 analyst — Juniper bulletin is JS-only (supportportal) and NVD empty via web-cli; no affected/fixed versions or cache path confirmed. CERT-FR AVI-1337 (JSA112528, 16 Oct) lists SSR <7.0.5, 7.1.x <7.1.7, 7.2.x <7.2.3 but names no CVE, so not applied. Nothing verified; no exploitation or PoC found. Sibling CVE-2026-103403 hit the same dead end.

## Documents

- [advisory] NVD: CVE-2026-103402 https://nvd.nist.gov/vuln/detail/CVE-2026-103402
- [mentions] CERT-FR AVI-1337: Juniper SSR (cites JSA112528, 16 Oct 2026; no CVE ids) https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1337/

## From the sources

An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache files.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_