Loading vulnerability…
Unauthenticated Root Command Injection in Juniper Session Smart Conductor AutomatedProvisioner
CVE-2026-103406 is an operating system command injection vulnerability in the AutomatedProvisioner component of Juniper Networks Session Smart Conductor. Improper neutralization of special elements in a Salt minion ID allows an unauthenticated remote attacker to inject and execute arbitrary operating system commands as root during key management. Affected releases include versions before 7.0.5, 7.1.x before 7.1.7, and 7.2.x before 7.2.3.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can fully compromise the affected Conductor with root privileges, allowing access to sensitive information, modification of system data and configuration, and disruption of services. The vulnerability has high confidentiality, integrity, and availability impacts.
Patch, then assume compromise.
Upgrade Juniper Networks Session Smart Conductor to version 7.0.5, 7.1.7, or 7.2.3, or a later fixed release in the applicable release branch, following Juniper advisory JSA112183.
No public exploits tracked yet. Mallory keeps watching.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.