Session Smart Conductor CVE-2026-103406

Exploitation requires network access to the Session Smart Conductor's Salt-based AutomatedProvisioner, the component that processes salt minion IDs during minion enrollment/provisioning; the malicious payload is delivered as a crafted salt minion ID whose special shell characters are not neutralized (CWE-78). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed against the exposed provisioning interface, so the primary limiting factor is reachability of the Conductor's Salt provisioning endpoint - environments that restrict that interface to trusted management networks substantially reduce exposure. No non-default configuration is stated as required by the available sources.

All available severity signals point the same direction and reinforce the act_now priority label supplied in the input. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated vulnerability with no user interaction, and the CWE-78 OS command injection yields full root code execution (C:H/I:H/A:H), consistent with the 9.8 base score. The vuln.today decision label is act_now, and the vulnerability was reported by the vendor (Juniper) itself, which lends credibility to the affected-component and privilege claims. However, several corroborating signals are absent from the provided data: there is no EPSS exploitation-probability score, no CISA KEV listing, and no PoC/exploit reference. Exploitation status is therefore 'no public exploit identified at time of analysis' - the act_now label reflects the pre-exploitation severity and the trivially exploitable unauthenticated-root profile of a network controller, not confirmed in-the-wild activity. This is a genuine high priority rather than a high-CVSS-but-low-real-risk issue, because the affected product is a centralized SD-WAN/routing controller and root command execution on it compromises the managed fabric; the main caveat is that real-world urgency rests on CVSS plus the vendor act_now label alone, with no independent exploitation telemetry (EPSS/KEV) to confirm or temper it.

A remote attacker who can reach the Session Smart Conductor's Salt-based AutomatedProvisioner sends a specially crafted salt minion ID containing OS command metacharacters, which is improperly neutralized and executed by the underlying shell. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires no authentication, no user interaction, and only low attack complexity, and the resulting commands run as root. No public exploit has been identified at time of analysis, so a working exploit would need to be developed.