Loading vulnerability…
PCLI Cache Authenticity Verification Failure in Juniper Session Smart Router and Conductor
CVE-2026-103402 is an insufficient verification of data authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor. PCLI processes model cache files without adequately verifying their authenticity, allowing an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges. Affected releases include versions before 7.0.5, 7.1.x before 7.1.7, and 7.2.x before 7.2.3.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution and privilege escalation on the affected router or conductor, potentially compromising system confidentiality, integrity, and availability. The vulnerability has a CVSS v3.1 base score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The specific execution identity and resulting privilege level are not specified.
If you can’t patch tonight, do this now.
As an interim precaution, restrict write access to the model cache directory to trusted accounts that require it and monitor for unauthorized cache modifications. No vendor-specified workaround is identified; these precautions do not replace upgrading.
Patch, then assume compromise.
Upgrade affected Session Smart Router and Session Smart Conductor installations to version 7.0.5, 7.1.7, or 7.2.3, or a later fixed release in the applicable release branch, following Juniper security advisory JSA112183.
No public exploits tracked yet. Mallory keeps watching.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.