Session Smart Router CVE-2026-103394

Exploitation is tied to the router's security policy assignment: the improper initialization is reached through how a security policy is assigned on the Session Smart Router, so the vulnerable state is a function of that policy/configuration path rather than any default-everywhere condition. Limiting factors: the CVSS AC:H rating indicates the attack requires conditions beyond the attacker's control (the available sources do not describe the exact trigger), the rated impact is confined to a limited denial of service (A:L), and the advisory detail sits behind the Juniper support portal (JSA112183). The description's traffic-decryption claim is not reflected in the scored confidentiality impact, so whether decryption is realistically achievable should be confirmed with the vendor.

This is a low-severity, low-priority issue rather than an urgent one, and the signals are internally consistent on that point. The vuln.today Decision label is 'monitor' (not act_now or emergency), the CVSS base score is only 3.7, and there is no CISA KEV listing and no EPSS value supplied, so there is no evidence of active or probable exploitation. The provided CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) describes a network-reachable, no-authentication, no-user-interaction flaw whose exploitation is gated by high attack complexity (AC:H) and whose only rated impact is a limited availability loss (A:L). One notable internal conflict should be flagged for verification: the description states the flaw 'allows an attacker to decrypt traffic' - a confidentiality impact - yet the vendor-supplied vector rates C:N, so the officially scored impact does not capture the traffic-decryption effect the prose claims; verify the true confidentiality impact with Juniper (JSA112183). No EPSS, KEV, or working-exploit signals contradict the low-priority reading.

A remote attacker targets a Session Smart Router whose security policy assignment leaves an SSR data path in an improperly initialized state, then either observes/decrypts traffic that should have been protected or sends traffic that drives the affected component into a limited denial-of-service condition. The high attack complexity means success depends on conditions outside the attacker's direct control rather than a simple repeatable request. No public exploit code or PoC was identified in the provided data.