CVE-2026-103406 is a critical OS command injection flaw (CVSS 9.8) in the AutomatedProvisioner component of Juniper Networks Session Smart Conductor. A remote attacker can use it to run arbitrary commands as root by sending a specially crafted salt minion ID.
What Is It
CVE-2026-103406 is an Improper Neutralization of Special Elements used in an OS Command vulnerability (CWE-78). It is in the AutomatedProvisioner component of Juniper Networks Session Smart Conductor. According to the vendor description, a remote attacker can execute arbitrary commands as root by supplying a specially crafted salt minion ID.
Juniper's SIRT ([email protected]) reported the issue, and it was published to NVD on 2026-10-28. NVD lists its status as "Awaiting Analysis," so the scoring and details below come from the vendor's submission.
Why It Matters
Juniper rates this flaw 9.8 (CRITICAL) under CVSS 3.1, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In practice:
- Network-reachable: it can be exploited remotely.
- Low complexity: no special conditions are required.
- No privileges or user interaction: an unauthenticated attacker can trigger it alone.
- High impact: confidentiality, integrity, and availability are all fully affected.
Commands run as root, so successful exploitation means full control of the Conductor. The Conductor is the central management point for a Session Smart deployment, which makes it a valuable target.
Exploitation status: No CISA KEV entry was supplied for this CVE. Active exploitation is not confirmed by KEV at the time of writing.
What's Vulnerable
Juniper Networks Session Smart Conductor, in these version ranges:
- All versions before 7.0.5
- 7.1.0 up to (but not including) 7.1.7
- 7.2.0 up to (but not including) 7.2.3
Versions outside these ranges are listed as unaffected by default.
Patch Status
The affected ranges end at 7.0.5, 7.1.7, and 7.2.3, which suggests those are the fixed releases on each branch. Juniper has published advisory JSA112183. Administrators should check that advisory for confirmed fixed versions and any workarounds, and upgrade Session Smart Conductor deployments out of the affected ranges.
There is no KEV entry, so no CISA-mandated remediation deadline applies right now. Given the unauthenticated, root-level, network-exploitable profile, patching should still be treated as a priority.