{"id":"CVE-2026-103406","published":"2026-10-28T17:17:25.830","lastModified":"2026-10-28T17:17:26.133","description":"An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://supportportal.juniper.net/JSA112183","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A command injection flaw in Juniper's Session Smart Conductor allows unauthenticated remote attackers to execute arbitrary OS commands as root by injecting shell metacharacters into the salt minion ID used during automated provisioning.","exploitability":"Trivial to exploit remotely without authentication or user interaction, requiring only network access to the vulnerable AutomatedProvisioner service.","blast_radius":"Full system compromise of the affected device is likely, enabling complete data exfiltration, persistence, lateral movement, and destruction of services.","remediation":"Upgrade to Juniper Session Smart Conductor version 2.590 or later, as specified in the vendor advisory for CVE-2026-103406.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","os-command","juniper","salt","provisioning"],"model":"garnet-coder","analyzedAt":"2026-10-29T08:41:59.339Z"}}