CVE-2026-33784
Reported by juniper · Published April 9, 2026
A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device. vLWC software images ship with an initial password for a high privileged account. A change of this password is not enforced during the provisioning of the software, which can make full access to the system by unauthorized actors possible.This issue affects all versions of vLWC before 3.0.94.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| virtual_lightweight_collector | juniper | 3.0.94 |
| JSI LWC | Juniper Networks | 3.0.94 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Juniper Networks | JSI LWC | 0 |
| Juniper Networks | JSI LWC | 0 |
Timeline
- Apr 8, 2026 CVE Published
- Apr 13, 2026 CVE Updated
- May 18, 2026 EPSS Score (30 in total, the first dated here)
- Jun 2, 2026 Security Advisory
- Jun 24, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-33784
vulnetix vdb fixes CVE-2026-33784Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-33784/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart