CVE-2026-47865 VMware CVE debrief

Who should care

System administrators and security professionals responsible for VMware Avi Load Balancer installations should be aware of this vulnerability and take immediate action to mitigate the risk.

Technical summary

The CVE-2026-47865 vulnerability in VMware Avi Load Balancer has a CVSS score of 9.8 and is classified as CRITICAL. It allows for authentication bypass, enabling a malicious user with network access to access the Avi Control plane. Affected versions are 31.1.1 through 31.2.2, 30.1.1 through 30.2.6, and 22.1.1 through 22.1.7. Fixes are available in versions 31.2.2-2p3 and 30.2.7. The CVE record was published on 2026-07-18T09:17:08.287Z and has not been modified since then. The NVD entry is currently in the 'Received' status. Limited information is available about the vulnerability's impact and exploitation.

Defensive priority

High

Recommended defensive actions

• Apply the available patches (31.2.2-2p3 or 30.2.7) to fix the authentication bypass vulnerability.
• Restrict network access to the Avi Control plane to minimize exposure.
• Monitor for any suspicious activity related to authentication attempts on the Avi Load Balancer.
• Verify that current versions are not within the affected ranges (31.1.1 through 31.2.2, 30.1.1 through 30.2.6, 22.1.1 through 22.1.7).
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-18T09:17:08.287Z and has not been modified since then. The NVD entry is currently in the 'Received' status. Limited information is available about the vulnerability's impact and exploitation. Further verification is needed to confirm affected deployments and assess potential exposure.

Official resources