EUVD-2026-21078
GHSA-r893-59mm-pxrg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess JSI vLWC CLI as high-privileged user
-
ExploitInject shell commands into CLI menu input
-
ExecutionExecute commands with root permissions
-
ImpactAchieve complete system control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Strict input allowlisting
|
| Exploitation Conditions | Requires local access to the Juniper Networks JSI vLWC CLI with high-privilege credentials (versions before 3.0.94). Attacker must input crafted shell commands via the CLI menu to execute code as root. |
| Impact | CVSS 8.4 with high severity impact reflects root privilege escalation via local shell injection. Limited by high privilege requirement (PR:H) and local attack vector, but unauthenticated shell command execution post-compromise is critical. Organizations running JSI vLWC should prioritize patching before 3.0.94 to prevent administrative takeover by privileged insiders. |
| Exploit ScenarioDerived | Authenticated high-privileged user submits unvalidated shell metacharacters via JSI vLWC CLI menu. CLI processes input without sanitization and executes injected commands as root, enabling full system compromise. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Command injection in Juniper Networks Support Insights Virtual Lightweight Collector (JSI vLWC) CLI enables local high-privileged attackers to escalate privileges to root. Inadequate input validation in the CLI menu permits shell command injection, with injected commands executing at root level. All JSI vLWC versions before 3.0.94 affected. CVSS 8.4 (High severity, local vector). Requires high-level existing privileges (PR:H). No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: Upgrade JSI vLWC to version 3.0.94 or later to remediate command injection vulnerability. This version includes corrected input validation logic for CLI menu processing. Organizations unable to immediately upgrade should restrict local administrative access to JSI vLWC systems, enforce multi-factor authentication for high-privilege accounts, and implement monitoring for abnormal CLI activity patterns. No effective workaround exists for environments requiring CLI access; upgrade is mandatory mitigation. Full vendor advisory and technical details: https://kb.juniper.net/JSA106016. Deployment priority should align with local access control posture and presence of high-privileged user accounts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vulnerability stems from CWE-183 (Permissive List of Allowed Inputs) implementation flaw in CLI menu processing. Shell metacharacters or command sequences bypass input sanitization, enabling arbitrary command execution via insufficient input validation. Commands inherit root context from CLI process, converting local high-privilege access to complete system control. Affects cpe:2.3:a:juniper_networks:jsi_lwc across all pre-3.0.94 releases.
Know when Jsi Lwc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/R:U/RE:M
Primary rating from Vendor (juniper) · only source for this CVE.
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
A Permissive List of Allowed Input vulnerability in the CLI of Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows a local, high privileged attacker to escalate their privileges to root.
The CLI menu accepts input without carefully validating it, which allows for shell command injection. These shell commands are executed with root permissions and can be used to gain complete control of the system.
This issue affects all JSI vLWC versions before 3.0.94.
Executive ViewAI
Juniper Networks Support Insights Virtual Lightweight Collector (JSI vLWC) versions prior to 3.0.94 contain a command injection vulnerability in the CLI that allows high-privileged local users to escalate to root access. This impacts organizations using JSI vLWC for infrastructure monitoring and support functions, creating insider risk and potential lateral movement pathways for attackers with elevated system access.
Apply vendor patch. Interim mitigation pending patched release: restrict CLI access to JSI vLWC to essential administrative staff only; implement network-level access controls limiting CLI connectivity to isolated management networks; conduct privileged access reviews for accounts with JSI vLWC CLI permissions and enforce principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB