{"schema":"threatline.record/2","record":{"id":"CVE-2026-106079","aliases":[],"summary":"Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration","details":"An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YANG configuration.","categories":["Network & edge"],"product":"Session Smart Router","vendor":"Juniper Networks","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106079","source_modified_at":"2026-10-28T16:37:49.668Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"Session Smart Router","vendor":"Juniper Networks","versions":[{"lessThan":"7.0.5","status":"affected","version":"0","versionType":"custom"},{"lessThan":"7.1.7","status":"affected","version":"7.1.0","versionType":"custom"},{"lessThan":"7.2.3","status":"affected","version":"7.2.0","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106079","source_modified_at":"2026-10-28T16:37:49.668Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"Session Smart Conductor","vendor":"Juniper Networks","versions":[{"lessThan":"7.0.5","status":"affected","version":"0","versionType":"custom"},{"lessThan":"7.1.7","status":"affected","version":"7.1.0","versionType":"custom"},{"lessThan":"7.2.3","status":"affected","version":"7.2.0","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106079","source_modified_at":"2026-10-28T16:37:49.668Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"Session Smart Router","ecosystem":null},"version":"7.0.5","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106079","source_modified_at":"2026-10-28T16:37:49.668Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"Session Smart Router","ecosystem":null},"version":"7.1.7","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106079","source_modified_at":"2026-10-28T16:37:49.668Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"Session Smart Router","ecosystem":null},"version":"7.2.3","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106079","source_modified_at":"2026-10-28T16:37:49.668Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"Session Smart Conductor","ecosystem":null},"version":"7.0.5","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106079","source_modified_at":"2026-10-28T16:37:49.668Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"Session Smart Conductor","ecosystem":null},"version":"7.1.7","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106079","source_modified_at":"2026-10-28T16:37:49.668Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"Session Smart Conductor","ecosystem":null},"version":"7.2.3","basis":"first unaffected version stated in the CVE record"}],"cvss":8.8,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T16:37:49.668Z","modified_at":"2026-10-28T16:37:49.668Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-106079","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T16:37:49.668Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://supportportal.juniper.net/JSA112183","tags":["vendor-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T16:37:49.668Z","content_hash":"3db712f43b275f2ef8c3524e2b02464790062150f5a251b603a2873f28a2215a"}}