Log in Start free

Vulnerability · Published Oct 28, 2026 · Assigned by juniper

CVE-2026-103400Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanup

Medium 5.5

In plain English

A medium-severity injection in Session Smart Conductor from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 92.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the ember service in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with local access to unmount arbitrary filesystems or cause a denial of service via the creation of specially named directories and a service restart.

Affected products (as reported)

VendorProductVersions
Juniper Networks Session Smart Router 0 – before 7.0.57.1.0 – before 7.1.77.2.0 – before 7.2.3
Juniper Networks Session Smart Conductor 0 – before 7.0.57.1.0 – before 7.1.77.2.0 – before 7.2.3

Weakness: CWE-74 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References