CVE-2026-47867 VMware CVE debrief

Who should care

Security teams and administrators responsible for VMware Avi Load Balancer instances should be aware of this vulnerability and take immediate action to mitigate the risk. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed, review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review.

Technical summary

CVE-2026-47867 is a remote code execution vulnerability in VMware Avi Load Balancer. A malicious user with network access may be able to access the Avi Control plane and execute code remotely. The affected versions are 32.1.1 (fixed in 32.1.2), 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3), 30.1.1 through 30.2.6 (fixed in 30.2.7), and 22.1.1 through 22.1.7 (fixed in 30.2.7). The vulnerability has a high CVSS score of 8.7, indicating a high severity. To mitigate this vulnerability, it is recommended to apply the available patches (32.1.2, 31.2.2-2p3, 30.2.7) to vulnerable instances, restrict network access to the Avi Control plane, and monitor for suspicious activity.

Defensive priority

High priority due to the high CVSS score of 8.7 and the potential for remote code execution.

Recommended defensive actions

• Apply the available patches (32.1.2, 31.2.2-2p3, 30.2.7) to vulnerable instances
• Restrict network access to the Avi Control plane
• Monitor for suspicious activity and implement compensating controls
• Inventory and verify the versions of VMware Avi Load Balancer instances
• Consider implementing additional security measures such as web application firewalls
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-07-18T09:17:08.527Z and has not been modified since then. The NVD entry is currently available. The vendor is listed as Unknown Vendor with low confidence, and there is a candidate vendor name Broadcom. The vulnerability has a high CVSS score of 8.7, indicating a high severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.