CVE-2026-103406

Summary

A command injection flaw in Juniper's Session Smart Conductor allows unauthenticated remote attackers to execute arbitrary OS commands as root by injecting shell metacharacters into the salt minion ID used during automated provisioning.

Exploitability

Trivial to exploit remotely without authentication or user interaction, requiring only network access to the vulnerable AutomatedProvisioner service.

Blast radius

Full system compromise of the affected device is likely, enabling complete data exfiltration, persistence, lateral movement, and destruction of services.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Juniper Session Smart Conductor version 2.590 or later, as specified in the vendor advisory for CVE-2026-103406.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.