CVE-2026-47866
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
VMware Avi Load Balancer has an authorization bypass vulnerability. An attacker on the network can access a limited subset of the Avi Control Plane without proper authorization. Multiple versions affected, patches available.
Risk Assessment
An attacker can gain unauthorized access to part of the load balancer configuration, potentially leading to information disclosure or further attacks.
Recommendation
Apply the appropriate patch for your version (e.g., 32.1.2, 31.2.2-2p3, 30.2.7). Restrict network access to the management interface.
Other vulnerabilities in VMware Avi Load Balancer
See all- CVE-2026-47865Critical
VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access can access the Avi Control plane without authentication.
- CVE-2026-47871High
Directory traversal vulnerability in VMware Avi Load Balancer. An authenticated network user can perform directory traversal attacks.
- CVE-2026-47870High
Vulnerability in VMware Avi Load Balancer allowing privilege escalation. A malicious authenticated user with network access can execute remote code.
- CVE-2026-47869High
VMware Avi Load Balancer contains a remote code execution vulnerability. An authenticated attacker with network access can inject and execute code.
- CVE-2026-47868High
Vulnerability in VMware Avi Load Balancer allows a local user to escalate privileges to root. An attacker with local access can exploit this flaw to run code with administrator privileges.
- CVE-2026-47867High
VMware Avi Load Balancer contains a remote code execution vulnerability. An unauthenticated attacker with network access can access the Avi Control plane and execute code remotely.
Original NVD description (English source)
VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)