{"id":"CVE-2026-103407","kind":"vulnerability","aliases":["CVE-2026-103407"],"related":[],"title":"Juniper Session Smart Router: REST user can read or delete arbitrary host files","description":"An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API.","summary":"In Juniper Session Smart Router and Session Smart Conductor, ConfigDirector has a path traversal flaw in its certificate and private-key REST API. An authenticated REST user can read, overwrite, or delete arbitrary certificate and key files on the host filesystem.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","juniper","network-appliance","rest-api","session-smart-conductor","session-smart-router"],"not_affected_if":["auth-required","no-rest-users"],"how_to_check":"unknown: Juniper advisory for this CVE not read. Check your SSR/Conductor version (show system version) and list accounts with REST/API access on the Conductor.","fix":"unknown for this CVE. JSA112528 patch notification (unconfirmed link) mentions SSR 7.0.5, 7.1.7, 7.2.3; confirm against the Juniper advisory before upgrading.","status":"open","published_at":"2026-10-28T17:17:26+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","triaged_at":"2026-10-28T17:34:21+00:00","updated_at":"2026-10-28T17:36:13+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-28T17:34:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Juniper Session Smart Router: REST user can read or delete arbitrary host files","impact":"high","summary":"In Juniper Session Smart Router and Session Smart Conductor, ConfigDirector has a path traversal flaw in its certificate and private-key REST API. An authenticated REST user can read, overwrite, or delete arbitrary certificate and key files on the host filesystem.","category":"infrastructure","nicknames":[],"who_cares":["juniper","session-smart-router","session-smart-conductor","network-appliance"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads, overwrites or deletes host certificate and private-key files","analyst_note":"Find the Juniper security advisory for CVE-2026-103407 to get affected and fixed versions, and confirm whether the REST API is enabled by default.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-rest-users","auth-required"],"who_is_affected":"Teams running Juniper Session Smart Router or Session Smart Conductor with REST API users enabled are exposed. The sources do not name affected versions or say whether the REST API is on by default, so check the vendor advisory for the exact release range. Installations without REST users, and the 'Session Smart' appliances that have no REST access, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000586,"input_tokens":3337,"output_tokens":505,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Juniper security advisory for CVE-2026-103407 to get affected and fixed versions, and confirm whether the REST API is enabled by default.","search":"'-103407':16A,19A '-2026':15A,18A 'allow':101C 'api':27B,59B,128C 'applianc':24B 'arbitrari':11A,69B,111C 'authent':61B,103C 'certif':53B,70B,112C,122C 'conductor':31B,44B,100C 'configdirector':45B,90C 'cve':14A,17A 'delet':10A,68B,110C 'directori':87C 'file':13A,73B,115C 'filesystem':77B,119C 'flaw':50B 'host':12A,76B,118C 'improp':79C 'infrastructur':20B 'junip':1A,21B,37B,92C 'key':57B,72B,114C,126C 'limit':80C 'network':23B,93C 'network-appli':22B 'overwrit':66B,108C 'path':48B 'pathnam':83C 'privat':56B,125C 'private-key':55B,124C 'read':8A,65B,107C 'rest':5A,26B,58B,62B,104C,127C 'rest-api':25B 'restrict':86C 'router':4A,35B,40B,96C 'session':2A,29B,33B,38B,42B,94C,98C 'session-smart-conductor':28B 'session-smart-rout':32B 'smart':3A,30B,34B,39B,43B,95C,99C 'travers':49B 'user':6A,63B,105C 'via':120C 'vulner':88C","nicknames":[],"mitigations":[],"who_affected":"Teams running Juniper Session Smart Router or Session Smart Conductor where ConfigDirector's certificate and private-key REST API is reachable by an authenticated REST user. Such a user can read, overwrite or delete certificate and key files on the host, so look at who holds REST credentials. The affected versions and whether the REST API is on by default are not yet confirmed from Juniper's own text. Installations with no REST users can lower priority.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"sirt@juniper.net","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103407","severity":null,"published_at":"2026-10-28T17:17:26+00:00","modified_at":"2026-10-28T17:17:26+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","fetched_at":"2026-10-28T17:34:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103407:967","url":null,"severity":null,"published_at":"2026-10-28T17:36:13+00:00","modified_at":"2026-10-28T17:36:13+00:00","first_seen_at":"2026-10-28T17:36:13+00:00","fetched_at":"2026-10-28T17:36:13+00:00","note":"Could not find the Juniper advisory naming CVE-2026-103407; Juniper portal pages render blank. Related JSA112528 (2026-10-16 SSR/Conductor patch notification, via CERT-FR) lists SSR <7.0.5, 7.1.x <7.1.7, 7.2.x <7.2.3, but no source ties it to this CVE (published 12 days later). Versions left unset; nothing verified. REST-on-by-default unconfirmed. Settle by reading the Juniper SIRT advisory for this CVE or the NVD references."}],"documents":[{"id":11633,"url":"https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1337/","title":"CERT-FR AVI-1337: Juniper SSR (cites JSA112528, 16 Oct 2026; no CVE ids)","kind":"other","source":"analyst","text":"Affected: SSR before 7.0.5; 7.1.x before 7.1.7; 7.2.x before 7.2.3. Source: Juniper JSA112528 of 16 Oct 2026. Does not name CVE-2026-103402.","published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":11634,"url":"https://supportportal.juniper.net/s/article/On-Demand-Session-Smart-Router-SSR-and-Conductor-patch-release-notification","title":"On Demand: Session Smart Router (SSR) and Conductor patch release notification (HPE/Juniper, 2026-10-16)","kind":"vendor","source":"analyst","text":"Vendor pre-notification: patch releases SSR/Conductor 7.0.5, 7.1.7, 7.2.3 available as of 2026-10-16 with critical security fixes; vulnerabilities publicly disclosed 2026-10-28. Affects all versions of SSR and Conductor. Workaround: N/A. Does not list individual CVEs.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}