CVE-2026-103406
Juniper Networks Session Smart Conductor
- Juniper Networks Session Smart Conductor
- Critical
- CVSS 9.8
- Fixed version listed
Summary
An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.
From the CVE record.
What to do
Fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| Juniper Networks Session Smart Conductor | before 7.0.5; from 7.1.0, before 7.1.7; from 7.2.0, before 7.2.3 | 7.0.5, 7.1.7, 7.2.3 |
Advisories and fixes
- Vendor advisory supportportal.juniper.net
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.8 (v3.1, scored by juniper)
- Weakness
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- Vendor
- Juniper Networks, Session Smart Conductor
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.