CVE-2026-47865: Authentication Bypass in VMware Avi Load Balancer
TL;DR - Critical auth bypass in VMware Avi Load Balancer control plane, CVSS 9.8. - Affects 31.1.1-31.2.2, 30.1.1-30.2.6, and 22.1.1-22.1.7. - Patch immediately to 31.2.2-2p3 or 30.2.7; no confirmed in-the-wild exploitation yet.
Vulnerability at a Glance
CVE-2026-47865 is a critical authentication bypass affecting VMware Avi Load Balancer, as documented by NVD and Broadcom in VMSA-2026-0005. The vulnerability allows a remote attacker with network access to bypass authentication and access the Avi Control plane. Because the affected component is the management plane rather than a data-plane feature, defenders should treat this as a high-priority exposure even though current public reporting does not confirm active exploitation.
The most important operational detail is simple: if your Avi Controller is reachable from untrusted networks and is running an affected version, assume elevated risk until you patch or tightly restrict access. The vendor has published fixed versions, but the exact implementation-level root cause has not been disclosed in the verified primary sources available at the time of writing.
| Field | Value |
|---|---|
| CVE ID | CVE-2026-47865 |
| CVSS score | 9.8 (Critical) |
| Attack vector | Network |
| Auth required | None, based on vendor description of authentication bypass |
| Patch available | Yes |
What Is This Vulnerability?
At a high level, this is an authentication bypass in the Avi Control plane. Broadcom and NVD describe the impact consistently: a malicious user with network access may be able to access the control plane by bypassing the authentication mechanism. In practical terms, this means the security boundary protecting administrative access can fail before valid credentials are presented or enforced.
That distinction matters because the control plane is typically where administrators manage virtual services, pools, certificates, policies, service engines, tenants, and integrations. A successful bypass could expose configuration state and potentially enable unauthorized administrative actions, depending on the deployment and role model in use. Even without public exploit details, a control-plane auth bypass is one of the highest-risk classes of management-plane flaw.
The exact coding defect or protocol weakness has not been disclosed in the primary sources cited here. There is no verified public vendor explanation yet covering whether the issue involves session handling, request routing, header trust, API gateway logic, or another mechanism. Defenders should avoid assuming a narrow attack path and instead treat all externally reachable controller management interfaces as potentially exposed until fixed.
A second implication is that compensating controls should focus on reducing control-plane reachability and monitoring management access patterns, not just user logon failures. Authentication bypasses can generate fewer of the usual signs associated with password attacks because the attacker may never need to brute-force credentials at all.
Who Is Affected?
The affected product is VMware Avi Load Balancer. Based on the NVD entry and Broadcom advisory, the following version ranges are affected:
- 31.1.1 through 31.2.2, fixed in 31.2.2-2p3
- 30.1.1 through 30.2.6, fixed in 30.2.7
- 22.1.1 through 22.1.7, fixed in 30.2.7
These ranges should be read literally. If you are operating any controller in those release trains, it should be treated as vulnerable unless Broadcom support has explicitly provided a different remediation path for your environment. The notable versioning wrinkle is the 22.x line: the published fix reference points to 30.2.7, which suggests the remediation path for affected 22.1.x deployments may require upgrading to a later supported train rather than applying a 22.x-specific patch. That is unusual enough that change owners should confirm compatibility, support status, and upgrade sequencing with vendor guidance before production rollout.
Organizations most at risk are those exposing the Avi Controller management interface to shared administrative networks, VPN user ranges, or any segment not tightly limited to a small set of bastion hosts. Managed service providers, enterprises with centralized network platforms, and environments where the controller is internet-reachable by design or misconfiguration should prioritize this issue first.
If you do not have a current asset inventory for Avi Controller nodes, start by identifying all management plane instances and mapping their reachable interfaces. In the absence of deeper public exploit specifics, defenders should assume any exposed controller on an affected version is a candidate target.
CVSS Score Breakdown
The verified score for CVE-2026-47865 is CVSS v3.1 9.8 (Critical). The exact vector string was not available in the retrieved compact NVD output used for this article, so it would be inappropriate to invent the full metric tuple. Still, the published score and vendor wording strongly indicate a worst-case profile consistent with remote exploitation and no required authentication.
A 9.8 score usually signals a combination of severe properties: network reachability, low attack complexity, no privileges required, and high impact across confidentiality, integrity, and availability. That aligns with the vendor summary here. If an attacker can bypass the control-plane authentication boundary, the likely consequences extend beyond simple information disclosure and into unauthorized administrative access.
From a prioritization standpoint, the score should be interpreted alongside exposure. A vulnerable controller isolated to a private management enclave behind strict ACLs is still urgent, but a controller reachable from broad internal ranges or external networks is more likely to be targeted quickly after disclosure. Since the issue affects the administrative plane of a network infrastructure product, defenders should rank it closer to critical firewall, hypervisor, or identity-management flaws than to ordinary application bugs.
Because the full vector string is not verified in the available source set, SOC and patch teams should rely on the confirmed facts: critical severity, network-accessible attack path, and authentication bypass impact. That is enough to justify emergency patch review.
Exploitation Status
At the time of writing, there is no verified evidence from the cited primary sources that CVE-2026-47865 is being actively exploited in the wild. CISA’s Known Exploited Vulnerabilities catalog does not currently list this CVE. That means there is no CISA-backed confirmation of active exploitation as of 2026-07-18.
There is also no verified public proof-of-concept confirmed from the retrieved primary-source evidence used for this article. Searches surfaced the official Broadcom advisory, VMware Security Blog references, and third-party coverage, but no primary-source PoC publication or vendor statement on exploitation was established.
That said, defenders should not mistake the absence of confirmation for safety. Control-plane authentication bypasses are highly attractive to attackers because they can provide immediate administrative footholds without credential theft. In the gap between advisory publication and widespread scanning visibility, opportunistic probing often begins before formal exploitation reporting catches up.
The correct operational statement is therefore: no confirmed active exploitation, no verified public PoC from the sources reviewed, but high practical risk due to the nature of the vulnerability. If your change windows are limited, treat this as an urgent maintenance event rather than waiting for exploitation telemetry to mature.
How to Detect It
Detection is challenging because the root-cause mechanics are not publicly documented. You are unlikely to have a perfect signature on day one. Instead, defenders should monitor for anomalous access to the Avi Controller management interfaces, especially successful requests or session creation patterns that are not preceded by normal authentication workflows.
Start by reviewing controller access logs, reverse proxy logs if present, and upstream network telemetry for management endpoints. Focus on unexpected source IPs, unusual request volume against administrative URLs, and any successful API or UI activity occurring outside standard admin hours. If your environment normally enforces VPN or jump-host access, any direct client connection to controller interfaces from user subnets should be treated as suspicious.
Technical Notes
The exact log fields vary by deployment, but defenders should hunt for patterns combining management-plane access with missing or abnormal authentication events. Example indicators to search for:
- Repeated HTTP 200/302 responses to controller admin or API paths from previously unseen IPs
- Access to /login, /api/, /admin/, or controller UI paths without a preceding normal auth sequence
- Sudden creation of API sessions or configuration reads from service accounts or unknown clients
- Direct connections to controller management ports from non-bastion hosts
Example Splunk-style hunt query for reverse proxy or web access logs in front of the controller:
index=proxy OR index=web
(host="avi-controller*" OR url_domain="avi-controller")
(uri_path="/login" OR like(uri_path, "/api/%") OR like(uri_path, "/admin%"))
| stats count min(_time) as firstSeen max(_time) as lastSeen values(status) values(src_ip) by uri_path, user, src_ip
| where count > 10 OR isnull(user)
Example network-focused check with Zeek-style HTTP logs, looking for management endpoint access from unexpected sources:
event http_request(c: connection, method: string, host: string, uri: string, version: string)
{
if ( host == "avi-controller.example.com" &&
/\/(api|admin|login)/ in uri )
print fmt("Avi controller management access: %s %s from %s",
method, uri, c$id$orig_h);
}
If you do not have detailed controller logs, fall back to perimeter controls. Review firewall, load balancer, and VPN logs to determine which source IPs can reach the Avi Controller management interface and whether that access matches intended administration paths.
Mitigation and Patching
The primary mitigation is to upgrade to a fixed version published by the vendor. The verified fix targets are:
- Upgrade 31.1.1 through 31.2.2 to 31.2.2-2p3
- Upgrade 30.1.1 through 30.2.6 to 30.2.7
- Upgrade 22.1.1 through 22.1.7 to 30.2.7
If you are on the 22.1.x train, validate the upgrade path carefully. The published fix reference points to 30.2.7 rather than a 22.x hotfix, so administrators should review release notes, interoperability constraints, backup procedures, and rollback options before proceeding. In environments with change-control rigor, that means confirming controller cluster state, configuration backups, and service engine compatibility before upgrading.
Where immediate patching is not possible, reduce exposure aggressively. Restrict management-plane reachability to dedicated bastion hosts or admin VPN ranges. Remove any public internet exposure. Enforce network ACLs around the Avi Control plane, and if a reverse proxy or upstream firewall is used, limit allowed source addresses and management paths. These are not substitutes for patching, but they meaningfully reduce attack surface while maintenance is being scheduled.
Technical Notes
Because deployment methods vary, use vendor-approved upgrade procedures for your environment. At a minimum, document current version, export configuration backups, and validate cluster health before and after change execution.
Example version validation and package handling workflow on a Linux-based admin host managing the upgrade artifacts:
# Record current version from your change log or controller UI/API
date
echo "Verify current Avi Controller version before upgrade"
# Validate downloaded image or package checksum against vendor-provided values
sha256sum avi-controller-update.pkg
# Upload the approved update package using your normal administrative workflow
# Then schedule controller upgrade to:
# - 31.2.2-2p3
# - 30.2.7
Example immediate exposure reduction using a perimeter firewall, allowing only a bastion host to reach management HTTPS:
# Example only; adapt to your firewall platform and management subnet
iptables -A INPUT -p tcp -s 10.10.10.25 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
If you rely on upstream network policy rather than host firewalls, implement an equivalent rule on your segmentation firewall or security group. Also disable any unnecessary external publishing of the controller UI until the upgrade is complete.
References
The primary source for remediation and severity is Broadcom’s security advisory. That advisory identifies the affected product as VMware Avi Load Balancer, assigns the issue a critical severity, and provides the fixed versions. It should be treated as the authoritative patch source for production change planning.
NVD provides the normalized CVE record and the affected version ranges quoted in this article. The VMware Security Blog also references the same advisory and helps validate product naming and advisory continuity, but the Broadcom advisory remains the key operational reference for defenders.
- NVD CVE entry: https://nvd.nist.gov/vuln/detail/CVE-2026-47865
- Broadcom advisory (VMSA-2026-0005): https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926
- VMware Security Blog: https://blogs.vmware.com/security/
- CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
In short, CVE-2026-47865 deserves immediate attention because it targets the Avi Control plane and does not require defenders to wait for exploitation confirmation before acting. Patch to 31.2.2-2p3 or 30.2.7 as applicable, and clamp down management-plane exposure while the change is underway.
For further reading on securing your network, check out our articles on how to secure your home router and attack surface management.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.