Session Smart Conductor CVE-2026-103404

Requires a local user presence on the Session Smart Conductor host: the description states a local user accesses sensitive routing credentials via triggering RoutingManager processes that write to the /tmp directory, where incorrect permission assignment (CWE-732) leaves those credential files readable by unauthorized local users. The exact process trigger and whether specific RoutingManager activity must be induced is not described in the available sources. The main limiting factor is this local-access prerequisite - despite the input CVSS encoding AV:N/PR:N (network, unauthenticated), the text implies the attacker must already have a local account on the Conductor; this discrepancy should be confirmed against Juniper JSA112183 before treating it as remotely/unauthenticated exploitable.

This is a medium-severity local information-disclosure issue (vendor CVSS 6.8) whose real-world priority is moderate, not urgent. The signals are mostly quiet: there is no EPSS probability in the provided data, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is supplied - so the status is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', consistent with a non-emergency, schedule-the-patch posture rather than act_now. The most important caveat is an internal conflict in the input: the CVSS vector encodes AV:N (network, unauthenticated, PR:N) with a scope change (S:C), yet the description explicitly states a 'local user' triggers processes that write to /tmp and then reads sensitive routing credentials. A network/unauthenticated vector and a local-user prerequisite cannot both be literally true - verify the true attack vector with Juniper (JSA112183). If exploitation genuinely requires a local account on the Conductor (as the text implies), the practical risk is lower than AV:N suggests, because it presupposes an attacker already on the host; the primary danger is privilege/credential escalation (disclosed routing credentials enabling further access), which is what the S:C scope-change signal likely reflects.

A user with local access to the Session Smart Conductor triggers a RoutingManager process that writes routing credentials to /tmp with overly permissive permissions, then reads those credentials from the world-accessible file. The stolen routing credentials could then be reused to pivot or gain broader access within the managed routing fabric. No public exploit or PoC is referenced in the available data; the exact trigger beyond 'processes that write to /tmp' is not detailed in the sources.