Live › vulnerability › CVE-2026-106079
Go to dashboardAccessManager in Juniper Session Smart Router and Session Smart Conductor fails to neutralize OS command characters in YANG configuration. An attacker with config-write privileges can execute arbitrary commands as root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Operators running Juniper Session Smart Router or Session Smart Conductor with AccessManager in use. Accounts that can write configuration are the attack path. The sources do not name affected or fixed versions.
No product ranges from the sources yet.
Unknown until Juniper's bulletin is read: check the SSR/Conductor version (show system version on the Conductor/router) against the fixed versions in the Juniper bulletin, and list which accounts hold config-write (admin) rights.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YANG configuration.
This page as .md · .json · in your agent: get_signal("CVE-2026-106079")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.