93← Home

CVE-2026-103406 (CVSS 9.8): An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Junipe

Headline from NVD · compiled from 6 sources

Our analysis · checked against 6 sources

Juniper patches root command-injection flaw in Session Smart Conductor; no known exploitation

Juniper's 28 October advisory says unauthenticated remote attackers could run commands as root on Session Smart Conductor via a crafted salt minion ID; it is one of 2 flaws scored 9.8 among 18 CVEs, fixed in 7.0.5, 7.1.7 and 7.2.3. No workaround exists, and Juniper says it knows of no malicious exploitation.

The framing'Critical CVEs' does fit the 9.8 score for an unauthenticated network flaw giving root command execution. But Juniper says it knows of no malicious exploitation, and none of the advisory's 18 CVEs was in CISA's exploited-vulnerabilities catalog when checked on 28 October 2026.

What the headline leaves out

  • Juniper says it is not aware of malicious exploitation, and none of the 18 CVEs was in CISA's exploited catalog (version 2026.10.27) on 28 October 2026.
  • There is no workaround; the only fix is upgrading to 7.0.5, 7.1.7 or 7.2.3.
  • VulDB says no exploit is available; a page titled 'PoC exploit' only restates the CVE description.
  • Juniper's own security testing found the flaw, not an outside researcher.

What happens next

There is no further dated step; the fix released on 28 October 2026 is the only remedy, as no workaround exists. National CERTs in Guyana and South Korea advised upgrading affected installations. Watch for a CISA exploited-catalog listing, a Juniper advisory update, or publication of working exploit code.

Possible knock-on effects
  • National CERT advisories could prompt operators to upgrade sooner, which may shrink the pool of exposed Conductor systems, mattering to network operators using the product. (official assessment: Guyana's National CIRT and South Korea's KISA/KrCERT advised reviewing and upgrading, per Mallory.ai. Watch for: Further CERT or vendor notices on upgrade uptake)
  • Because no workaround exists, systems not upgraded could stay fully exposed if exploit code appears, which may matter to operators who delay patching. (mechanism: Follows from the CVE records stating the upgrade is the only fix. Watch for: A CISA catalog listing or a working public exploit)

Sources: CVE-2026-103406 record (primary), VulDB entry 428034 (primary), Brandefense: Juniper Session Smart Router vulnerability JSA112183, Sploitus: CVE-2026-103406, OffSeq Radar: CVE-2026-103406, Mallory.ai story

Written in our own words from the sources above, and checked claim by claim before it was published. The report below says only what each outlet said.

The report: what outlets said

According to the CVE record, as reported by Rapid7, a flaw in Juniper Networks' Session Smart Conductor could let a remote attacker execute arbitrary commands as root via a specially crafted salt minion ID[1]

THREATINT's CVE listing shows that CVE-2026-103406 was Published 2026-10-28[2], with Juniper as the assigner and a "CRITICAL: 9.8" CVSS score. Strix notes that NVD analysis[3] was still "pending" when it published.VulDB says the flaw affects Juniper Session Smart Conductor up to 7.0.4/7.1.6/7.2.2[4]. It says the exploitability is told to be easy[4] and that exploitation doesn't require any form of authentication[4].Brandefense reports that the CVE is part of Juniper bulletin JSA112183[5], which covers 18 CVEs in Session Smart Router and Session Smart Conductor. According to Brandefense, two score CVSS 9.8: CVE-2026-103409 (Router) and CVE-2026-103406 (Conductor)[5].Brandefense also reports that Juniper fixed all of them in 7.0.5, 7.1.7 and 7.2.3[5], and that the bulletin lists no known workarounds[5]. Brandefense adds that Juniper says its own product security testing or research found the issues[5].Brandefense says Juniper SIRT says it is not aware of malicious exploitation[5]. The outlet also says none of the 18 CVEs is in CISA's catalog[5], based on a check made on 28 October.OffSeq's Threat Radar lists the flaw as not known to be exploited[6]. It advises that operators patch Juniper Networks Session Smart Conductor as a priority[6].

Listen to the songCritical CVEs (1 of 3) — November 04, 2026

Sources

  1. [1]CVE-2026-103406: Juniper Networks Session Smart Conductor: An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in… | Rapid7 Vulnerability Database
  2. [2]CVE-2026-103406
  3. [3]CVE-2026-103406: Session Smart Conductor OS Command Injection
  4. [4]CVE-2026-103406 Juniper Session Smart Conductor AutomatedProvisioner os command injection
  5. [5]Juniper Session Smart Router Vulnerability - Brandefense
  6. [6]CVE-2026-103406: Session Smart Conductor · OS Command Injection | Threat Radar

Every sentence here reports what a named outlet said, with a link to it. Compiled by 93 from the reporting below.

This topic, day by day

CVE-2026-103406 (CVSS 9.8): An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Junipe | 93