CVE-2026-47868
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Vulnerability in VMware Avi Load Balancer allows a local user to escalate privileges to root. An attacker with local access can exploit this flaw to run code with administrator privileges.
Risk Assessment
The organization is at risk of full system compromise by a local user, potentially leading to data confidentiality and integrity breaches.
Recommendation
Update VMware Avi Load Balancer to the version specified in the vulnerability description (e.g., 32.1.2, 31.2.2-2p3, 30.2.7).
Other vulnerabilities in VMware Avi Load Balancer
See all- CVE-2026-47865Critical
VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access can access the Avi Control plane without authentication.
- CVE-2026-47871High
Directory traversal vulnerability in VMware Avi Load Balancer. An authenticated network user can perform directory traversal attacks.
- CVE-2026-47870High
Vulnerability in VMware Avi Load Balancer allowing privilege escalation. A malicious authenticated user with network access can execute remote code.
- CVE-2026-47869High
VMware Avi Load Balancer contains a remote code execution vulnerability. An authenticated attacker with network access can inject and execute code.
- CVE-2026-47867High
VMware Avi Load Balancer contains a remote code execution vulnerability. An unauthenticated attacker with network access can access the Avi Control plane and execute code remotely.
- CVE-2026-47866High
VMware Avi Load Balancer has an authorization bypass vulnerability. An attacker on the network can access a limited subset of the Avi Control Plane without proper authorization. Multiple versions affected, patches available.
Original NVD description (English source)
VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate their privileges to run code as root. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)