Use of Default Password Vulnerability in Juniper Networks' vLWC
CVE-2026-33784

9.3CRITICAL

Key Information:

Vendor

Juniper Networks
Status
Jsi Lwc
Vendor
CVE Published:
9 April 2026

Badges

👾 Exploit Exists

What is CVE-2026-33784?

A security vulnerability exists in the Virtual Lightweight Collector (vLWC) from Juniper Networks, allowing unauthenticated network-based attackers to gain complete control over devices. This is due to the presence of an initial default password for a high-privileged account, which is not enforced to be changed during the software provisioning process. As a result, attackers can exploit this vulnerability to gain unauthorized access to the system, emphasizing the need for secure password practices.

Affected Version(s)

JSI LWC vLWC 0 < 3.0.94

References

https://kb.juniper.net/JSA107871
vendor-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.