Vulnerability · Published Apr 9, 2026 · Assigned by juniper

CVE-2026-21915JSI Virtual Lightweight Collector: Shell escape allows privilege escalation to root

Medium 6.7

In plain English

A medium-severity security flaw in JSI LWC from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities).

Severity (CVSS 3.1)6.7Medium

Exploit odds (30 days)2.3%top 16.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A Permissive List of Allowed Input vulnerability in the CLI of Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows a local, high privileged attacker to escalate their privileges to root. The CLI menu accepts input without carefully validating it, which allows for shell command injection. These shell commands are executed with root permissions and can be used to gain complete control of the system. This issue affects all JSI vLWC versions before 3.0.94.

Affected products (as reported)

Vendor	Product	Versions
Juniper Networks	JSI LWC	0 – before 3.0.94

Weakness: CWE-183 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://kb.juniper.net/JSA106016 vendor-advisory