CVE-2026-103406 Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.
CriticalCVSS 9.8
EPSS 0.52%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| juniper Session Smart Conductor | < 7.0.5 | 7.0.5 |
| juniper Session Smart Conductor | >= 7.1.0, < 7.1.7 | 7.1.7 |
| juniper Session Smart Conductor | >= 7.2.0, < 7.2.3 | 7.2.3 |
References
- supportportal.juniper.net vendor-advisory