{"metadata": {"vulnerability": "CVE-2026-103406", "count": 24, "kinds": {"milestone": 7, "sighting": 6, "kev": 0, "other": 11}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0462", "record": "NCSC-2026-0462", "field": "document.tracking.generator.date"}, {"timestamp": "2026-09-30T14:33:03.168Z", "date_only": false, "value": "2026-09-30T14:33:03.168Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-103406", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-28T00:00:00Z", "date_only": true, "value": "2026-10-28", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1414", "record": "CERTFR-2026-AVI-1414", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-28T16:00:00Z", "date_only": false, "value": "2026-10-28T16:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / juniper", "record": "CVE-2026-103406", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T16:22:54.275Z", "date_only": false, "value": "2026-10-28T16:22:54.275986Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3myx5wstoi42n", "record": "CVE-2026-103406", "field": "creation_timestamp", "uuid": "4068a5d8-dd35-41bc-9e52-30497bb6899f", "content": "Juniper security bulletin fixes 18 Session Smart Router vulnerabilities, including CVSS 9.8 flaws CVE-2026-103406 and CVE-2026-103409. Update now.\n\n#Juniper #SessionSmartRouter #SDWAN #CVE2026103406 #CVE2026103409 #NetworkSecurity #PatchNow #Vulnerability", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3myx5wstoi42n"}, {"timestamp": "2026-10-28T16:35:53.323Z", "date_only": false, "value": "2026-10-28T16:35:53.323Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-103406", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T16:35:53.323Z", "date_only": false, "value": "2026-10-28T16:35:53.323Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-103406", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-28T16:35:53.323Z", "date_only": false, "value": "2026-10-28T16:35:53.323Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / juniper", "record": "CVE-2026-103406", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-28T16:47:39.709Z", "date_only": false, "value": "2026-10-28T16:47:39.709700Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117519552293777655", "record": "CVE-2026-103406", "field": "creation_timestamp", "uuid": "7ee47f96-f122-47f8-a37a-edf58b781838", "content": "CVE-2026-103406 Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management. An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.\nhttps://www.cve.org/CVERecord?id=CVE-2026-103406https://supportportal.juniper.net/JSA112183#juniper #JuniperNetworks #SessionSmartConductor#CVE_2026_103406#bot", "url": "https://infosec.exchange/users/cve/statuses/117519552293777655"}, {"timestamp": "2026-10-28T17:17:25Z", "date_only": false, "value": "2026-10-28T17:17:25Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-4Q6M-6P89-9RMF", "record": "GHSA-4Q6M-6P89-9RMF", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-28T17:17:25.830Z", "date_only": false, "value": "2026-10-28T17:17:25.830", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103406", "record": "FKIE_CVE-2026-103406", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T17:17:26.133Z", "date_only": false, "value": "2026-10-28T17:17:26.133", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103406", "record": "FKIE_CVE-2026-103406", "field": "lastModified"}, {"timestamp": "2026-10-28T17:30:04.487Z", "date_only": false, "value": "2026-10-28T17:30:04.487335Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3myxboxbsjh2w", "record": "CVE-2026-103406", "field": "creation_timestamp", "uuid": "355846c9-c92b-45f4-a342-d3d67223fa00", "content": "CVE-2026-103406 - session smart conductor\nThe Session Smart Conductor system can be tricked by an unauthenticated user into running whatever commands they want on the server, giving them full administrator\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#junipernetworks #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3myxboxbsjh2w"}, {"timestamp": "2026-10-28T18:07:43.996Z", "date_only": false, "value": "2026-10-28T18:07:43.996973Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3myxdscc5qt2v", "record": "CVE-2026-103406", "field": "creation_timestamp", "uuid": "1bd74171-2c5b-4cdb-a5fd-aecbcd50e2b0", "content": "\ud83d\udea8 CVE-2026-103406 \u2014 CVSS 9.8 CRITICAL\n\nAn Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisio...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-103406\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3myxdscc5qt2v"}, {"timestamp": "2026-10-28T18:32:03Z", "date_only": false, "value": "2026-10-28T18:32:03Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-4Q6M-6P89-9RMF", "record": "GHSA-4Q6M-6P89-9RMF", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T18:32:03Z", "date_only": false, "value": "2026-10-28T18:32:03Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-4Q6M-6P89-9RMF", "record": "GHSA-4Q6M-6P89-9RMF", "field": "modified"}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1414", "record": "CERTFR-2026-AVI-1414", "field": "last_revision_date"}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1414", "record": "CERTFR-2026-AVI-1414", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1414", "record": "CERTFR-2026-AVI-1414", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-29T12:11:15.802Z", "date_only": false, "value": "2026-10-29T12:11:15.802099Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/vuldb/statuses/117524127766871725", "record": "CVE-2026-103406", "field": "creation_timestamp", "uuid": "be489b74-822d-48da-b0ec-e6ad4df49ec2", "content": "\u26a0\ufe0f The severity is increased for this new vulnerability affecting Juniper Session Smart Conductor (CVE-2026-103406) https://vuldb.com/vuln/428034", "url": "https://infosec.exchange/users/vuldb/statuses/117524127766871725"}, {"timestamp": "2026-10-30T03:02:27.202Z", "date_only": false, "value": "2026-10-30T03:02:27.202527Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mz2s5crjo225", "record": "CVE-2026-103406", "field": "creation_timestamp", "uuid": "931e530a-2f2a-4dee-9d6f-1130758706c3", "content": "Juniper\u306eSession Smart Router\u306b\u8106\u5f31\u602718\u4ef6\u3001CVSS 9.8\u306e2\u4ef6\u306f\u8a8d\u8a3c\u306a\u3057\u3067\u60aa\u7528\u3055\u308c\u308b\u6050\u308c-CVE-2026-103406,CVE-2026-103409 \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30cb\u30e5\u30fc\u30b9", "url": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mz2s5crjo225"}, {"timestamp": "2026-10-30T13:15:45.991Z", "date_only": false, "value": "2026-10-30T13:15:45.991474Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0462", "record": "NCSC-2026-0462", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-30T13:15:45.991Z", "date_only": false, "value": "2026-10-30T13:15:45.991474Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0462", "record": "NCSC-2026-0462", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T13:15:45.991Z", "date_only": false, "value": "2026-10-30T13:15:45.991474Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0462", "record": "NCSC-2026-0462", "field": "document.tracking.current_release_date"}], "metrics": {"as_of": "2026-10-31T00:54:18.214Z", "anchors": {"origin": {"timestamp": "2026-10-28T16:00:00Z", "date_only": false, "value": "2026-10-28T16:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / juniper", "record": "CVE-2026-103406", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T16:00:00Z", "date_only": false, "value": "2026-10-28T16:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / juniper", "record": "CVE-2026-103406", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 204858.214915, "hours": 56.90505969861111, "days": 2.3710441541087963, "min_seconds": 204858.214915, "max_seconds": 204858.214915, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T16:00:00Z", "date_only": false, "value": "2026-10-28T16:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / juniper", "record": "CVE-2026-103406", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-31T00:54:18.214Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}