CVE-2026-33784CWE-1393

JSI Virtual Lightweight Collector: Default password is not required to be changed which allows unauthorized high-privileged access

Critical · published April 9, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
40.6
In the wild
Unconfirmed
What it is

A Use of Default Password vulnerability in the Juniper Networks

Support Insights (JSI)

Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device.

vLWC software images ship with an initial password for a high privileged account. A change of this password is not enforced during the provisioning of the software, which can make full access to the system by unauthorized actors possible.This issue affects all versions of vLWC before 3.0.94.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/RE:L
EPSS
0.00483 · 40.6th percentile
Weakness
CWE-1393 · Use of Default Password
Published
2026-04-09T21:36Z
EPSS history
Timeline
  • 09 APR 21:36Z
    JSI Virtual Lightweight Collector: Default password is not required to be changed which allows unauthorized high-privileged access
    cvelistv5