CVE-2026-47870 VMware CVE debrief

Who should care

System administrators and security teams responsible for VMware Avi Load Balancer installations should prioritize patching this vulnerability to prevent potential remote code execution.

Technical summary

The vulnerability, tracked as CVE-2026-47870, is a privilege escalation issue in VMware Avi Load Balancer. It has a CVSS score of 7.1 and is classified as HIGH severity. An authenticated user with network access could potentially exploit this vulnerability to execute remote code. Affected versions include 32.1.1, 31.1.1 through 31.2.2, 30.1.1 through 30.2.6, and 22.1.1 through 22.1.7. Fixes are available in versions 32.1.2, 31.2.2-2p3, and 30.2.7.

Defensive priority

High priority should be given to patching this vulnerability due to its high severity and potential impact. System administrators and security teams should focus on verifying system configurations and applying patches as soon as possible. Monitoring for suspicious activity and implementing compensating controls can help mitigate potential risks until patches are applied. Defensive measures should be prioritized based on the vulnerability's CVSS score of 7.1 and its classification as HIGH severity. The vulnerability's potential impact on system security and the likelihood of exploitation should be carefully assessed. Affected versions include 32.1.1, 31.1.1 through 31.2.2, 30.1.1 through 30.2.6, and 22.1.1 through 22.1.7. Fixes are available in versions 32.1.2, 31.2.2-2p3, and 30.2.7. System administrators and security teams should prioritize patching to prevent potential remote code execution. The vulnerability is a privilege escalation issue in VMware Avi Load Balancer that could allow an authenticated user with network access to execute remote code. A high-severity privilege escalation vulnerability exists in VMware Avi Load Balancer. A malicious authenticated user with network access may be able to execute remote code. The affected versions are 32.1.1, 31.1.1 through 31.2.2, 30.1.1 through 30.2.6, and 22.1.1 through 22.1.7. Fixes are available in versions 32.1.2, 31.2.2-2p3, and 30.2.7. System administrators and security teams responsible for VMware Avi Load Balancer installations should prioritize patching this vulnerability to prevent potential remote code execution. The vulnerability, tracked as CVE-2026-47870, is a privilege escalation issue in VMware Avi Load Balancer. It has a CVSS score of 7.1 and is classified as HIGH severity. An authenticated user with network access could potentially exploit this vulnerability to execute remote code. Affected versions include 32.1.1, 31.1.1 through 31.2.2, 30.1.1 through 30.2.6, and 22.1.1 through 22.1.7. Fixes are available in versions 32.1.2, 31.2.2-2p3, and 30.2.7. Given the high severity and potential impact, it is crucial to assess the vulnerability's likelihood of exploitation and implement necessary security

Recommended defensive actions

• Apply patches to affected VMware Avi Load Balancer versions
• Restrict network access to authenticated users
• Monitor for suspicious activity
• Inventory and verify system configurations
• Implement compensating controls if patching is not immediate

Evidence notes

The CVE record was published on 2026-07-18T09:17:08.847Z and has not been modified since then. The NVD entry is currently in the 'Received' status. Limited details are available about the vulnerability's exploitation or affected scope. Defenders should verify system configurations, review available patches, and monitor for suspicious activity related to VMware Avi Load Balancer. Evidence is limited, and further verification is required to understand the full impact.

Official resources