Article
Juniper Session Smart Router Vulnerability: 18 CVEs, Two Rated 9.8
The Juniper Session Smart Router vulnerability bulletin lists 18 CVEs, two rated 9.8. See which hit the Router or Conductor and which versions fix…
Read more
Vulnerability
Juniper Session Smart Conductor Command Injection (CVE-2026-103406)
An OS command injection flaw in the AutomatedProvisioner of Juniper Networks Session Smart Conductor.
- CVE ID
- CVE-2026-103406
- CVSS
- 9.8 Critical (CVSS v3.1, Juniper)
- Affected product
- Juniper Networks Session Smart Conductor (AutomatedProvisioner)
- Exploited
- Unknown
- Published
- 28 October 2026
In short
CVE-2026-103406 is an OS command injection flaw in the AutomatedProvisioner of Juniper Networks Session Smart Conductor. Juniper says a remote attacker can run arbitrary commands as root through a specially crafted salt minion ID. The bulletin words it as an unauthenticated attacker causing command execution during key management. The flaw scores CVSS 9.8 and is fixed in Conductor 7.0.5, 7.1.7 and 7.2.3, as Juniper bulletin JSA112183 of 28 October 2026 states.
- CVECVE-2026-103406
- ProductJuniper Networks Juniper Networks Session Smart Conductor (AutomatedProvisioner)
- Fix Steps5actions listedFind every Conductor · Upgrade to a fixed release
What it allows
Juniper's CVE record describes an OS command injection in the AutomatedProvisioner of Session Smart Conductor. Improper neutralization of special elements lets a remote attacker execute arbitrary commands as root through a specially crafted salt minion ID. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Juniper's bulletin words it as an unauthenticated attacker causing arbitrary command execution during key management. Neither the bulletin nor the record says whether a Conductor is reachable from the Internet.
This flaw is on the Conductor only, and the CVE record lists no Session Smart Router version for it. The other CVSS 9.8 flaw in the bulletin is a separate issue in the Router, described on our CVE-2026-103409 page.
Juniper SIRT states that it is not aware of malicious exploitation. CISA's Known Exploited Vulnerabilities catalog, version 2026.10.27, does not list the CVE (checked 28 October 2026). Our news post on the Juniper bulletin compares all 18 CVEs.
Who is affected
Juniper's bulletin says all versions of Session Smart Conductor before 7.0.5, 7.1.7 and 7.2.3 are affected. The CVE record gives the ranges as every version below 7.0.5, 7.1.0 up to but not including 7.1.7, and 7.2.0 up to but not including 7.2.3. It lists no Session Smart Router version for this flaw.
Juniper fixed the flaw in 7.0.5, 7.1.7 and 7.2.3 and all subsequent releases. Its CVE record says no workaround exists.
Juniper SIRT's policy is not to evaluate releases beyond End of Engineering (EOE) or End of Life (EOL).
Timeline
- 30 Sep 2026
Juniper, as the CVE assigner, reserves the CVE id.
- 28 Oct 2026
Juniper publishes bulletin JSA112183 with fixes in 7.0.5, 7.1.7 and 7.2.3. The CVE and NVD records are published the same day. Juniper SIRT says it is not aware of malicious exploitation.
What to do
-
Find every Conductor
List each Session Smart Conductor with its version. Versions before 7.0.5, 7.1.7 or 7.2.3 on their release line are affected.
-
Upgrade to a fixed release
Install 7.0.5, 7.1.7 or 7.2.3, or a later release. Juniper's CVE record says no workaround exists.
-
Keep management access narrow
This is general hardening advice from us, not from Juniper: keep the Conductor's management interfaces off untrusted networks. It does not replace the upgrade.
-
Plan for end-of-life releases
Juniper SIRT does not evaluate releases beyond End of Engineering or End of Life. If a Conductor runs one, plan the move to a supported release.
-
Watch for changes
Check the Juniper bulletin, the NVD record and the CISA catalog again over the coming days. Juniper's statement on exploitation can change.
Questions
What is CVE-2026-103406?
It is an OS command injection flaw in the AutomatedProvisioner of Juniper Session Smart Conductor. Juniper says a remote attacker can run arbitrary commands as root through a crafted salt minion ID. It scores CVSS 9.8.
Which versions are affected and which fix it?
Juniper says all versions of Session Smart Conductor before 7.0.5, 7.1.7 and 7.2.3 are affected. Releases 7.0.5, 7.1.7, 7.2.3 and all subsequent ones fix it.
Is CVE-2026-103406 exploited?
Juniper SIRT says it is not aware of malicious exploitation. CISA's catalog version 2026.10.27 does not list the CVE (checked 28 October 2026).
Is there a workaround for CVE-2026-103406?
Juniper's CVE record says no workaround exists. The fix is the upgrade.
Does CVE-2026-103406 affect Session Smart Router?
Not according to the CVE record, which lists only Session Smart Conductor. The same bulletin fixes CVE-2026-103409 in the Router.
In our research
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 52 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 59 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 92 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.