CVE-2026-33784 Juniper Networks CVE debrief

Who should care

System administrators and security teams responsible for Juniper Virtual Lightweight Collector (vLWC) should be aware of CVE-2026-33784, as it allows unauthenticated, network-based attackers to gain full control of the device. All versions before 3.0.94 are affected. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

The Juniper Networks Virtual Lightweight Collector (vLWC) ships with a default password for a high-privileged account. This password is not changed during software provisioning, allowing unauthorized actors to gain full system access. The vulnerability affects all vLWC versions before 3.0.94. The issue can be mitigated by immediately upgrading to vLWC version 3.0.94 or later, changing the default password for the high-privileged account on existing vLWC instances, and implementing network-based access controls to restrict access to vLWC.

Defensive priority

High

Recommended defensive actions

• Immediately upgrade to vLWC version 3.0.94 or later
• Change the default password for the high-privileged account on existing vLWC instances
• Implement network-based access controls to restrict access to vLWC
• Monitor vLWC systems for unauthorized access attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-09T22:16:27.820Z and was last modified on 2026-07-08T03:20:22.177Z. The NVD entry is currently Analyzed. The vulnerability affects all versions of vLWC before 3.0.94. There is no evidence of exploitation in the wild. The vendor has provided an advisory for this issue.

Official resources