CVE-2026-103406
CVE-2026-103406 · Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.
CVSS 9.8 · Critical · EPSS 0.5% · Fix available
- Published
- Updated
Affected products and versions
session smart conductor
- Versions
- ≥ 0, < 7.0.5: Affected (custom)
- ≥ 7.1.0, < 7.1.7: Affected (custom)
- ≥ 7.2.0, < 7.2.3: Affected (custom)
Update to 7.0.5; Update to 7.1.7; Update to 7.2.3