This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] VMware Avi Load Balancer fixes 7 vulnerabilities
VMware fixes 7 vulnerabilities in its Avi Load Balancer product in versions 32.1.2, 31.2.2-2p3 and 30.2.7. The most severe vulnerabilities are listed below; the others can be found at [1].
An unauthenticated remote attacker can bypass the authentication mechanism and thereby gain unauthorized access to the control plane of the system (Avi Controller) [1].
The vulnerability is present in product:
- VMware Avi Load Balancer; >=22.1.1, <=22.1.7; >=30.1.1, <30.2.7; >=31.1.1, <31.2.2-2p3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-47865 at cve.org, NVD
- CWE-287: Improper Authentication at cwe.mitre.org
The vulnerability was publicly disclosed 14. 7. 2026.
An authenticated remote attacker can execute code within the control plane of the system (Avi Controller) [1].
The vulnerability is present in product:
- VMware Avi Load Balancer; >=22.1.1, <=22.1.7; >=30.1.1, <30.2.7; >=31.1.1, <31.2.2-2p3; ==32.1.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
More information:
- CVE-2026-47867 at cve.org, NVD
- CVE-2026-47869 at cve.org, NVD
- CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 14. 7. 2026.
An authenticated remote attacker can, due to insufficient path validation, access locations outside the designated directory [1].
The vulnerability is present in product:
- VMware Avi Load Balancer; >=22.1.1, <=22.1.7; >=30.1.1, <30.2.7; >=31.1.1, <31.2.2-2p3; ==32.1.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-47871 at cve.org, NVD
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org
The vulnerability was publicly disclosed 14. 7. 2026.
By CESNET, z.s.p.o. Ondrej Pavlovič on 20. 7. 2026.