CVE-2026-103406

CriticalCVSS 9.8

Published: 28/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Summary

An improper neutralization of special elements used in an OS command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.

Risk Assessment

A remote attacker can execute arbitrary commands with root privileges, leading to full compromise of the Conductor system. This may affect managed devices and the broader network infrastructure.

Recommendation

Apply the security updates provided by Juniper Networks for Session Smart Conductor. Restrict access to management interfaces to trusted networks.

Other vulnerabilities in Juniper Networks Session Smart Conductor

CVE-2026-103404Medium
An incorrect permission assignment for a critical resource in RoutingManager of Juniper Networks Session Smart Conductor allows a local user to access sensitive routing credentials by triggering processes that write to the /tmp directory.

Original NVD description (English source)

An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS