What’s Vulnerable › Vulnerabilities
CVE-2026-103406: Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-28 · updated 2026-10-28
- Weakness: CWE-78
Description
An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.
Summary
CVE-2026-103406 is a critical OS command injection flaw in the AutomatedProvisioner component of Juniper Networks Session Smart Conductor, allowing an unauthenticated remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID. With a CVSS score of 9.8, successful exploitation can lead to full system compromise. The issue affects Session Smart Conductor and is fixed in versions 7.0.5, 7.1.7, and 7.2.3. It is not listed in CISA KEV, so no known active exploitation has been confirmed; upgrade to a fixed release as soon as possible.
تُعد CVE-2026-103406 ثغرة حرجة من نوع حقن أوامر نظام التشغيل (OS Command Injection) في مكوّن AutomatedProvisioner ضمن Juniper Networks Session Smart Conductor، وتتيح لمهاجم عن بُعد غير مُصادَق تنفيذ أوامر عشوائية بصلاحيات root عبر معرّف salt minion مُصمَّم خصيصًا. وبتقييم CVSS يبلغ 9.8، قد يؤدي الاستغلال الناجح إلى اختراق كامل للنظام. تؤثر الثغرة في Session Smart Conductor وتم إصلاحها في الإصدارات 7.0.5 و7.1.7 و7.2.3. لا ترد الثغرة في قائمة CISA KEV، لذا لم يُؤكَّد استغلالها فعليًا؛ ويُنصح بالترقية إلى إصدار مُصلَح في أقرب وقت.
Affected products
- Juniper Networks Session Smart Conductor: before 7.0.5; from 7.1.0 before 7.1.7; from 7.2.0 before 7.2.3 — fixed in 7.0.5, 7.1.7, 7.2.3
How to fix
Upgrade to a fixed version: Juniper Networks Session Smart Conductor 7.0.5, 7.1.7, 7.2.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-103406 or the next vulnerability affects your stack