CVE-2026-33784

CVE-2026-33784 is a critical use of default password vulnerability affecting Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) software versions prior to 3.0.94. The vLWC ships with a default high-privileged account password that is not enforced to be changed during initial provisioning, allowing unauthorized actors to obtain full administrative access to affected devices. The vulnerability carries a CVSS score of 9.8 (Critical) and can be exploited by unauthenticated network-based attackers with no special privileges or user interaction required. The attack vector is network-based with low complexity, and successful exploitation results in complete compromise of system confidentiality, integrity, and availability. There is currently no evidence of active exploitation in the wild, and this vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog. The EPSS probability score of 0.00054 indicates relatively low probability of exploitation compared to the broader CVE landscape, and community attention remains inactive at this time. Organizations running affected vLWC versions should prioritize upgrading to version 3.0.94 or later and immediately change all default credentials as an interim measure.