Juniper Networks Default Credential Vulnerability Exposes Devices to Full Control Attacks

• •CVE-2026-33784 allows full control of Juniper vLWC devices via unchanged default credentials.
• •The vulnerability has a critical CVSS score of 9.8, indicating severe risk.
• •Organizations must upgrade to software release 3.0.94 or later to mitigate the flaw.

Juniper Networks has issued a critical security alert for a severe vulnerability in its Support Insights Virtual Lightweight Collector (vLWC), tracked as CVE-2026-33784. This flaw, which has a CVSS v3.1 score of 9.8, allows unauthenticated attackers to gain complete control over affected network devices. The vulnerability arises from the failure to require administrators to change a default password during the initial setup, leaving devices exposed to remote attackers on the same network. Once accessed, attackers can alter configurations, intercept data, and potentially launch further attacks within the corporate network. Organizations are urged to upgrade to software release 3.0.94 or later to resolve the issue. For immediate mitigation, administrators can manually change the default password. The vulnerability affects all deployments of the vLWC that have not been secured with a custom password. Cybersecurity teams should prioritize addressing this vulnerability due to its ease of exploitation and the lack of required technical skills for attackers.