CVE-2026-21915: JSI Virtual Lightweight Collector: Shell escape allows privilege escalation to root
A Permissive List of Allowed Input vulnerability in the CLI of Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows a local, high privileged attacker to escalate their privileges to root.
The CLI menu accepts input without carefully validating it, which allows for shell command injection. These shell commands are executed with root permissions and can be used to gain complete control of the system.
This issue affects all JSI vLWC versions before 3.0.94.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC)to a version that resolves this vulnerability.Fixed in 3.0.94
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21915?
The severity of CVE-2026-21915 is rated high with a score of 8.4.
How do I fix CVE-2026-21915?
To fix CVE-2026-21915, upgrade to software releases 3.0.94 or any subsequent versions.
What type of vulnerability is associated with CVE-2026-21915?
CVE-2026-21915 is a Command Injection vulnerability affecting the CLI of Juniper Networks Support Insights.
Who is affected by CVE-2026-21915?
CVE-2026-21915 affects users of Juniper Networks JSI Virtual Lightweight Collector who have local high privileges.
What can an attacker do with CVE-2026-21915?
An attacker leveraging CVE-2026-21915 can escalate their privileges to root on affected systems.