Juniper Networks Session Smart Conductor: Improper OS Command Neutralization (CVE-2026-103406)
An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.
CVE search metadata
CVE search record: CVE-2026-103406. Severity: critical. CVSS: 9.8. KEV: no. Product: Session Smart Conductor. Brief: Juniper Networks Session Smart Conductor: Improper OS Command Neutralization (CVE-2026-103406). Brief link: https://feed.craftedsignal.io/briefs/2026-10-juniper-session-smart-conductor/
Triage facts
Revision 2- Applicability
- Session Smart Conductor
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 2 public sources
- Freshness
- Revision 2Oct 28, 19:24 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: claim_state, has_poc, lastmod, poc_references, references, updates
Sources: 1
CVE-2026-103406 identifies a vulnerability in the AutomatedProvisioner component of Juniper Networks Session Smart Conductor. A remote attacker can execute arbitrary commands as root by utilizing a specially crafted salt minion ID.