Vulnerability · Published Apr 9, 2026 · Assigned by juniper

CVE-2026-33784JSI Virtual Lightweight Collector: Default password is not required to be changed which allows unauthorized high-privileged access

Critical 9.8

In plain English

A critical-severity security flaw in JSI LWC from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.5%top 58.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device. vLWC software images ship with an initial password for a high privileged account. A change of this password is not enforced during the provisioning of the software, which can make full access to the system by unauthorized actors possible.This issue affects all versions of vLWC before 3.0.94.

Affected products (as reported)

Vendor	Product	Versions
Juniper Networks	JSI LWC	0 – before 3.0.94

Weakness: CWE-1393 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://kb.juniper.net/JSA107871 vendor-advisory