{"id":"CVE-2026-106079","kind":"vulnerability","aliases":["CVE-2026-106079"],"related":[],"title":"Juniper Session Smart Router: config-write user can run commands as root","description":"An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YANG configuration.","summary":"AccessManager in Juniper Session Smart Router and Session Smart Conductor fails to neutralize OS command characters in YANG configuration. An attacker with config-write privileges can execute arbitrary commands as root.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","juniper","network-appliance","session-smart-conductor","session-smart-router"],"not_affected_if":["no-config-write-users"],"how_to_check":"Unknown until Juniper's bulletin is read: check the SSR/Conductor version (show system version on the Conductor/router) against the fixed versions in the Juniper bulletin, and list which accounts hold config-write (admin) rights.","fix":null,"status":"open","published_at":"2026-10-28T17:17:32+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","triaged_at":"2026-10-28T17:34:18+00:00","updated_at":"2026-10-28T17:35:10+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-28T17:34:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Juniper Session Smart Router: config-write user can run commands as root","impact":"high","summary":"AccessManager in Juniper Session Smart Router and Session Smart Conductor fails to neutralize OS command characters in YANG configuration. An attacker with config-write privileges can execute arbitrary commands as root.","category":"infrastructure","nicknames":[],"who_cares":["juniper","session-smart-router","session-smart-conductor","network-appliance"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary commands as root on the appliance","analyst_note":"Find the Juniper advisory for affected and fixed versions and the AccessManager configuration path at https://nvd.nist.gov/vuln/detail/CVE-2026-106079.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-config-write-users"],"who_is_affected":"Operators running Juniper Session Smart Router or Session Smart Conductor with AccessManager in use. Accounts that can write configuration are the attack path. The sources do not name affected or fixed versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000551,"input_tokens":3322,"output_tokens":438,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Juniper advisory for affected and fixed versions and the AccessManager configuration path at https://nvd.nist.gov/vuln/detail/CVE-2026-106079.","search":"'-106079':16A,19A '-2026':15A,18A 'accessmanag':33B,81C 'achiev':101C 'allow':92C 'applianc':24B 'arbitrari':61B,102C 'attack':53B,94C 'charact':48B 'command':11A,47B,62B,75C,77C,103C 'conductor':28B,42B,91C 'config':6A,56B,97C 'config-writ':5A,55B,96C 'configur':51B,110C 'cve':14A,17A 'element':70C 'execut':60B,104C 'fail':43B 'improp':66C 'infrastructur':20B 'inject':78C 'junip':1A,21B,35B,83C 'network':23B,84C 'network-appli':22B 'neutral':45B,67C 'os':46B,74C,76C 'privileg':58B,99C 'root':13A,64B,106C 'router':4A,32B,38B,87C 'run':10A 'session':2A,26B,30B,36B,40B,85C,89C 'session-smart-conductor':25B 'session-smart-rout':29B 'smart':3A,27B,31B,37B,41B,86C,90C 'special':69C 'use':71C 'user':8A 'vulner':79C 'write':7A,57B,98C 'yang':50B,109C","nicknames":[],"mitigations":[],"who_affected":"Operators running Juniper Session Smart Router or Session Smart Conductor with AccessManager in use. Accounts that can write configuration are the attack path. The sources do not name affected or fixed versions.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:17:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"sirt@juniper.net","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106079","severity":null,"published_at":"2026-10-28T17:17:32+00:00","modified_at":"2026-10-28T17:17:32+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","fetched_at":"2026-10-28T17:34:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-106079:963","url":null,"severity":null,"published_at":"2026-10-28T17:35:10+00:00","modified_at":"2026-10-28T17:35:10+00:00","first_seen_at":"2026-10-28T17:35:10+00:00","fetched_at":"2026-10-28T17:35:10+00:00","note":"Juniper bulletin for this CVE not readable (supportportal is JS-only, cve.org record empty via web-cli). No affected/fixed versions confirmed. CERT-FR AVI-1337 (JSA112528, 16 Oct) lists SSR <7.0.5, 7.1.x <7.1.7, 7.2.x <7.2.3 but does not name this CVE, so not applied. Nothing verified; no exploitation or PoC found. Revisit when NVD/Juniper text is available."}],"documents":[{"id":11631,"url":"https://www.cve.org/CVERecord?id=CVE-2026-106079","title":"CVE Record: CVE-2026-106079 (CNA: Juniper Networks)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}