Act nowDisclosed

Advisory · CVE-2026-103406

Unauthenticated remote code execution as root in Juniper Session Smart Conductor

A crafted salt minion ID lets a remote attacker run arbitrary commands as root on Juniper Session Smart Conductor. Juniper rates it critical at CVSS 9.8.

Advisory published October 28, 2026Independent summary
Vendor
Juniper Networks
Product
Session Smart Conductor
Identifier / CWE
CVE-2026-103406
CWE-78
Action timing
Immediate
ELI5

Explain it like I’m five

The conductor takes a worker name from a stranger and pastes it straight into a system command. A crafted name smuggles in extra commands that run as root.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Crafted minion ID

    A remote attacker sends a specially crafted salt minion ID to the AutomatedProvisioner.

  2. 02Command injection

    The value is not neutralized before use in an OS command.

  3. 03Root execution

    The injected commands run as root on the Conductor.

What happened

Juniper disclosed Session Smart releases before 7.0.5, 7.1.0 through 7.1.6, and 7.2.0 through 7.2.2 as affected for this flaw in the AutomatedProvisioner of Session Smart Conductor. An Improper Neutralization of Special Elements used in an OS Command vulnerability lets a remote attacker execute arbitrary commands as root via a specially crafted salt minion ID. Juniper rates it critical at CVSS 3.1 9.8 with no privileges required and no user interaction.

Fixed releases are 7.0.5, 7.1.7, or 7.2.3. The flaw is one of eight Session Smart issues Juniper disclosed together under JSA112183, and this is the most severe Conductor-only item in the set.

What to do

  1. Inventory Session Smart Conductor deployments.
  2. Upgrade to 7.0.5, 7.1.7, or 7.2.3 or later on the matching release line.
  3. Restrict network access to the Conductor and its provisioning interfaces until patched.
  4. Review provisioning and system logs for unusual minion IDs or unexpected commands.
  5. Confirm the deployed version after patching.

Management note

Unauthenticated root command execution on the central SD-WAN controller is a worst-case network flaw: one crafted identifier can compromise the box that manages the routers. Patch Conductor first, before the lower-scored items in the same bulletin.