CVE-2026-103406: AutomatedProvisioner (salt minion ID handling)
An OS command injection in the Session Smart Conductor AutomatedProvisioner lets a remote attacker execute arbitrary commands as root by supplying a specially crafted salt minion ID during key management.
Executive Summary & Technical Impact
An OS command injection in the Session Smart Conductor AutomatedProvisioner lets a remote attacker execute arbitrary commands as root by supplying a specially crafted salt minion ID during key management.
Tracked under CVE-2026-103406 (CWE-78 (OS Command Injection)), this vulnerability affects Session Smart Conductor before 7.0.5, 7.1.x before 7.1.7, 7.2.x before 7.2.3 and carries a severity score of 9.8 (CRITICAL). Engineering and security operations teams running Session Smart Conductor should prioritize upgrading to 7.0.5, 7.1.7, 7.2.3 and later.
Remediation & Patch Guidance
- Upgrade Session Smart Conductor to 7.0.5, 7.1.7, 7.2.3, or later.
- Restrict network reachability of Conductor provisioning and management services.
- Review Conductor logs for unexpected minion key requests.
Frequently Asked Questions (CVE-2026-103406)
What versions are affected by CVE-2026-103406?
CVE-2026-103406 affects Session Smart Conductor before 7.0.5, 7.1.x before 7.1.7, 7.2.x before 7.2.3 in Session Smart Conductor (AutomatedProvisioner (salt minion ID handling)).
How do I patch or remediate CVE-2026-103406?
Upgrade affected deployments to 7.0.5, 7.1.7, 7.2.3 and later and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-103406?
CVE-2026-103406 is rated CRITICAL with a CVSS score of 9.8 (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated Root on the Edge: Juniper Session Smart Router (CVE-2026-103409) and Sophos UTM (CVE-2026-118633)
Two October 28 advisories hit network edge gear: a pair of CVSS 9.8 flaws in Juniper's SD-WAN platform and a manual-patch-only RCE in end-of-life Sophos UTM.
Read full engineering post-mortem (5 min read) →