CVE-2026-33784
Juniper Virtual Lightweight Collector ≤ 3.0.94
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-33784 is a critical-severity Use of Default Password (CWE-1393) vulnerability in Juniper Virtual Lightweight Collector. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 39th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33784 is a Use of Default Password vulnerability (CWE-1393) in the Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC). The vLWC software images ship with an initial password for a high-privileged account, and a change of this password is not enforced during provisioning. This flaw affects all versions of vLWC prior to 3.0.94 and has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for complete compromise.
An unauthenticated, network-based attacker can exploit this vulnerability by using the default credentials to gain full control of the affected vLWC device. No special privileges, user interaction, or complex conditions are required, allowing remote exploitation over the network.
The Juniper Networks security advisory at https://kb.juniper.net/JSA107871 provides details on mitigation, which includes upgrading to vLWC version 3.0.94 or later where the issue is addressed.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21203
Vulnerability Data
A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device. vLWC software images ship with an initial password for a high…
more
privileged account. A change of this password is not enforced during the provisioning of the software, which can make full access to the system by unauthorized actors possible.This issue affects all versions of vLWC before 3.0.94.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Authenticator management requires verification of identity at initial distribution and secure handling that directly stops default passwords from remaining in use.
Configuration settings establish the most restrictive secure baselines, which include changing or disabling default passwords.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability scanning will discover default-password instances, enabling remediation, yet does not itself prevent their initial use.
Credential management directly requires replacing default passwords with unique, strong credentials.
Authentication policies can enforce non-default passwords but do not address the full scope of credential lifecycle.
Authorization policies assume credentials already exist and are not default; least-privilege helps limit impact but does not prevent defaults.
Hardened configuration baselines explicitly prohibit default passwords, covering most of the weakness but not all identity-management aspects.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandates secure handling and change of authentication secrets, directly addressing default passwords.
Requires secure authentication mechanisms, which includes replacing or disabling default credentials.
Configuration management processes typically enforce changing defaults during hardening.