CVE-2026-106079
Last modified
CVE-2026-106079 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YANG configuration..
Description
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YANG configuration.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Juniper Networks | Session Smart Router | < 7.0.5; >= 7.1.0, < 7.1.7; >= 7.2.0, < 7.2.3 |
| Juniper Networks | Session Smart Conductor | < 7.0.5; >= 7.1.0, < 7.1.7; >= 7.2.0, < 7.2.3 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-106079?
How severe is CVE-2026-106079?
How do I fix CVE-2026-106079?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-106072A flaw in Node.js TLS hostname verification allows a certifi…6.7
- CVE-2026-106073A flaw in Node.js Permission Model filesystem enforcement le…3.3
- CVE-2026-106074A flaw in Node.js `crypto` causes the internal entropy cache…4.8
- CVE-2026-106076A vulnerability allowing an authenticated organization-trans…9
- CVE-2026-106077A vulnerability allowing a user with the Veeam Backup for Mi…8.3
- CVE-2026-106078A vulnerability allowing an unauthenticated attacker to bypa…6.9
- CVE-2026-10608A security flaw has been discovered in DedeCMS 5.7.88. This …7.3
- CVE-2026-106087TRO600 contains an arbitrary file read vulnerability. An una…8.7
- CVE-2026-106089ColdFusion is affected by an Incorrect Authorization vulnera…8.8
- CVE-2026-10609A missing authorization flaw was found in the OpenShift Clus…6.8
- CVE-2026-106090ColdFusion is affected by an Incorrect Authorization vulnera…8.8
- CVE-2026-106095The Code Snippets WordPress plugin before 3.10.0 does not pe…3.3
Are you affected by CVE-2026-106079?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST