CVE-2026-47866 VMware CVE debrief

Who should care

Users of VMware Avi Load Balancer versions 32.1.1, 31.1.1 through 31.2.2, 30.1.1 through 30.2.6, and 22.1.1 through 22.1.7 should apply patches or mitigations. They should also review and restrict network access to Avi Control Plane and monitor for suspicious activity related to Avi Load Balancer. Additionally, they should verify the integrity of their Avi Load Balancer deployments and ensure that all necessary security measures are in place.

Technical summary

The vulnerability, CVE-2026-47866, is an authorization bypass issue in VMware Avi Load Balancer. Affected versions include 32.1.1 (fixed in 32.1.2), 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3), 30.1.1 through 30.2.6 (fixed in 30.2.7), and 22.1.1 through 22.1.7 (fixed in 30.2.7). The CVSS score is 8.3, indicating high severity. This issue allows a malicious actor on the network to access a limited subset of the Avi Control Plane without proper authorization. Users of VMware Avi Load Balancer should apply patches or updates to affected versions, review and restrict network access to Avi Control Plane, and monitor for suspicious activity related to Avi Load Balancer.

Defensive priority

High priority due to high CVSS score and potential for unauthorized access.

Recommended defensive actions

• Apply patches or updates to affected VMware Avi Load Balancer versions.
• Review and restrict network access to Avi Control Plane.
• Monitor for suspicious activity related to Avi Load Balancer.
• Verify the integrity of Avi Load Balancer deployments.
• Ensure that all necessary security measures are in place.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

Evidence is based on official CVE and NVD records, as well as a security advisory from Broadcom. However, details are limited, and further verification is recommended. The vulnerability, CVE-2026-47866, is an authorization bypass issue in VMware Avi Load Balancer. Affected versions include 32.1.1 (fixed in 32.1.2), 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3), 30.1.1 through 30.2.6 (fixed in 30.2.7), and 22.1.1 through 22.1.7 (fixed in 30.2.7). The CVSS score is 8.3, indicating high severity. Users of VMware Avi Load Balancer should review and restrict network access to Avi Control Plane and monitor for suspicious activity related to Avi Load Balancer.

Official resources