Is CVE-2026-103401 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-103401?

CVE-2026-103401 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-103401

Description

An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints. This vulnerability can be exploited on Mist-managed routers and on unmanaged Routers that have not yet been onboarded to a Conductor. Routers already managed by Conductor are not affected.