CVE-2026-103406: Command Execution in Juniper Conductor

CVE-2026-103406 is an Improper Neutralization of Special Elements used in an OS Command vulnerability within the AutomatedProvisioner component of Juniper Networks Session Smart Conductor. A remote attacker can execute arbitrary commands with root privileges by sending a specially crafted salt minion ID through provisioning mechanisms.

The vulnerability has a CVSS score of 9.8 and is classified as critical. It was published on the NVD on October 28, 2026. Signals on X/Twitter show 4 posts in the last 24 hours confirming awareness of the threat and reporting CVSS 9.8, consistent with official data. No public exploits are documented in GitHub repositories at this time.

Immediately check whether Session Smart Conductor is present in your network infrastructure. Consult Juniper Networks documentation for patches and apply them urgently. In the interim, isolate or segment Conductor systems if possible. Network teams must contact Juniper support for patch release timelines.

Session Smart Conductor is a critical component in Juniper Networks environments for provisioning and network management. Unauthenticated access with root command execution represents an immediate and severe risk capable of compromising entire infrastructure segments.