CVE-2026-103401

HighCVSS 8.8/10Last modified Nov 6, 2026

Description

An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints.

This vulnerability can be exploited on Mist-managed routers and on unmanaged Routers that have not yet been onboarded to a Conductor. Routers already managed by Conductor are not affected.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Juniper NetworksSession Smart Router< 7.0.5; >= 7.1.0, < 7.1.7; >= 7.2.0, < 7.2.3
Juniper NetworksSession Smart Conductor< 7.0.5; >= 7.1.0, < 7.1.7; >= 7.2.0, < 7.2.3

References

Timeline

Published
Oct 28, 2026
Last modified
Nov 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1034028.8An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart ConductorCVE-2026-1034038.8An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper NetwCVE-2026-1034046.8An Incorrect Permission Assignment for Critical Resource vulnerability in RoutingManager in Juniper Networks Session Smart Conductor allows CVE-2026-1034055.8An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the web server in JunCVE-2026-1034069.8An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session SCVE-2026-1034078.8An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and CVE-2026-1034088.8A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the CVE-2026-1034099.8A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-baseCVE-2026-1034107.5An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthenticated remote aCVE-2026-1034117.1An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker with local network acceCVE-2026-1034128.8Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan. A project file nameCVE-2026-1034138.8Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's `kuberne
CVE-2026-103401: High severity, CVSS 8.8 | Vulnix