CVE-2026-21915

MediumCVSS 6.7

Published: 09/04/2026(UTC)Updated: 08/07/2026(UTC)Translated: 09/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.24%

81th percentile - higher than 81% of all known CVEs

Summary

A vulnerability in the CLI of Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows a local, high-privileged attacker to escalate privileges to root. The CLI accepts input without proper validation, enabling shell command injection executed with root permissions.

Risk Assessment

An attacker with local access and high privileges can gain complete control of the system, compromising confidentiality, integrity, and availability of data and services.

Recommendation

Immediately update JSI vLWC to version 3.0.94 or later, which contains the fix for this vulnerability.

Original NVD description (English source)

A Permissive List of Allowed Input vulnerability in the CLI of Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows a local, high privileged attacker to escalate their privileges to root. The CLI menu accepts input without carefully validating it, which allows for shell command injection. These shell commands are executed with root permissions and can be used to gain complete control of the system. This issue affects all JSI vLWC versions before 3.0.94.