CVE-2026-47870
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Vulnerability in VMware Avi Load Balancer allowing privilege escalation. A malicious authenticated user with network access can execute remote code.
Risk Assessment
Risk of gaining control over the load balancer, potentially leading to application disruption and security breach.
Recommendation
Update VMware Avi Load Balancer to the versions specified in the description (e.g., 32.1.2, 31.2.2-2p3, 30.2.7).
Other vulnerabilities in VMware Avi Load Balancer
See all- CVE-2026-47865Critical
VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access can access the Avi Control plane without authentication.
- CVE-2026-47871High
Directory traversal vulnerability in VMware Avi Load Balancer. An authenticated network user can perform directory traversal attacks.
- CVE-2026-47869High
VMware Avi Load Balancer contains a remote code execution vulnerability. An authenticated attacker with network access can inject and execute code.
- CVE-2026-47868High
Vulnerability in VMware Avi Load Balancer allows a local user to escalate privileges to root. An attacker with local access can exploit this flaw to run code with administrator privileges.
- CVE-2026-47867High
VMware Avi Load Balancer contains a remote code execution vulnerability. An unauthenticated attacker with network access can access the Avi Control plane and execute code remotely.
- CVE-2026-47866High
VMware Avi Load Balancer has an authorization bypass vulnerability. An attacker on the network can access a limited subset of the Avi Control Plane without proper authorization. Multiple versions affected, patches available.
Original NVD description (English source)
VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to execute remote code. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)