CVE-2026-47869
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
VMware Avi Load Balancer contains a remote code execution vulnerability. An authenticated attacker with network access can inject and execute code.
Risk Assessment
An attacker can take control of the load balancer, potentially compromising network traffic integrity and confidentiality.
Recommendation
Upgrade VMware Avi Load Balancer to version 32.1.2, 31.2.2-2p3, or 30.2.7, depending on your version.
Other vulnerabilities in VMware Avi Load Balancer
See all- CVE-2026-47865Critical
VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access can access the Avi Control plane without authentication.
- CVE-2026-47871High
Directory traversal vulnerability in VMware Avi Load Balancer. An authenticated network user can perform directory traversal attacks.
- CVE-2026-47870High
Vulnerability in VMware Avi Load Balancer allowing privilege escalation. A malicious authenticated user with network access can execute remote code.
- CVE-2026-47868High
Vulnerability in VMware Avi Load Balancer allows a local user to escalate privileges to root. An attacker with local access can exploit this flaw to run code with administrator privileges.
- CVE-2026-47867High
VMware Avi Load Balancer contains a remote code execution vulnerability. An unauthenticated attacker with network access can access the Avi Control plane and execute code remotely.
- CVE-2026-47866High
VMware Avi Load Balancer has an authorization bypass vulnerability. An attacker on the network can access a limited subset of the Avi Control Plane without proper authorization. Multiple versions affected, patches available.
Original NVD description (English source)
VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute code. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)