CVE-2026-47865: critical vulnerability in VMware Avi Load Balancer
VMware Avi Load Balancer Authentication Bypass Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. It has an official Brazilian government alert.
ssvc Trackcvss 9.8epss 0.6%
Official alert in Brazil
Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.
- CISC Gov.br · 28 Jul 2026Boletim do CISC de Vulnerabilidaderead on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism.
Affected versions:
31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
30.1.1 through 30.2.6 (fixed in 30.2.7)
22.1.1 through 22.1.7 (fixed in 30.2.7)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
VMware · Avi Load BalancerRelated CVEs — VMware Avi Load Balancer
In the same product, most dangerous first.
CVE-2026-47871HIGHVMware Avi Load Balancer Directory Traversal VulnerabilityEPSS 1.0%CVE-2026-47869HIGHVMware Avi Load Balancer Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-47867HIGHVMware Avi Load Balancer Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-47870HIGHVMware Avi Load Balancer Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-47866HIGHVMware Avi Load Balancer Authorization Bypass VulnerabilityEPSS 0.4%CVE-2025-41233MEDIUMCVE-2025-41233EPSS 0.3%