by Kastro
Paper/Archive/CVE-2026-47865

CVE-2026-47865

VMware Avi Load Balancer — VMware Avi Load Balancer Authentication Bypass Vulnerability

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 49.3.493 × 209.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism. Affected versions: 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

Affected

ProductAffectedFixed inSource
Avi Load Balancer31.1.1 – 31.2.2–CNA
Avi Load Balancer30.1.1 – 30.2.6–CNA
Avi Load Balancer22.1.1 – 22.1.7–CNA

Scores by source

vmware (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsupport.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926