CVE-2026-47871: VMware Avi Load Balancer Directory Traversal
TL;DR - Authenticated users can abuse improper path validation in VMware Avi Load Balancer to perform directory traversal. - Affected branches include 22.1.x, 30.x, 31.x, and 32.1.1; fixed releases are available. - No public PoC or confirmed in-the-wild exploitation was identified in the cited sources, but patch promptly.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-47871 |
| CVSS score | 8.8 |
| Attack vector | Network |
| Auth required | Yes, authenticated user required |
| Patch available | Yes |
CVE-2026-47871 is a high-severity directory traversal vulnerability in Broadcom VMware Avi Load Balancer. According to NVD, the flaw is caused by improper file path validation and can be exploited by a malicious authenticated network user over the network.
For defenders, the practical implication is straightforward: this is not an unauthenticated internet worm risk based on the currently available data, but it is still serious because it affects an administrative and traffic-management platform that often sits close to critical application infrastructure. If an attacker already has valid access, traversal flaws can become a stepping stone to reading unintended files, accessing sensitive paths, or chaining into broader compromise depending on deployment specifics.
What Is This Vulnerability?
NVD describes CVE-2026-47871 as a directory traversal issue in VMware Avi Load Balancer caused by flaws in file path validation. Directory traversal vulnerabilities happen when an application accepts user-controlled path input and fails to properly restrict it to an intended directory. In practice, attackers try to inject sequences such as ../ or encoded equivalents to escape the expected file location and reach other paths on the underlying system.
The key constraint here is that exploitation requires an authenticated network user. That matters operationally. It means the exposed risk depends in part on who can log into the Avi management plane or related interfaces, how accounts are provisioned, whether SSO or API credentials are broadly distributed, and whether lower-privileged users can reach the vulnerable function. The public sources available for this CVE do not provide enough detail to say exactly which endpoint, API route, or workflow is vulnerable, so defenders should avoid over-assuming scope while still treating the issue as a real post-auth control failure.
Technical Notes
Because the vendor advisory text was not fully readable in the retrieved source material, the precise vulnerable parameter and code path are not public in the data used here. Defenders should assume common traversal encodings may be relevant until proven otherwise during vendor-guided validation:
GET /some/path?file=../../../../etc/passwd HTTP/1.1
Host: avi-controller.example
Cookie: session=...
Also consider encoded traversal attempts during review:
../
..%2f
..%252f
..\
%2e%2e%2f
Who Is Affected?
The affected product is Broadcom VMware Avi Load Balancer. Based on the CVE record and corroborating advisory references, the affected versions are explicitly listed as follows:
- 32.1.1 → fixed in 32.1.2
- 31.1.1 through 31.2.2 → fixed in 31.2.2-2p3
- 30.1.1 through 30.2.6 → fixed in 30.2.7
- 22.1.1 through 22.1.7 → fixed in 30.2.7
That version data is the most important operational input for triage. If you run any controller or related Avi deployment component on one of those builds, you should treat it as affected unless Broadcom has separately documented an exception for your topology. The version mapping also shows that the remedy is branch-specific in some cases and branch-jumping in others, particularly for the 22.1.x line, which is listed as fixed in 30.2.7 rather than a 22.1.x maintenance release in the available source material.
If you do not have an accurate inventory of Avi Controller versions, prioritize that first. In many environments, load balancer platforms are managed by a networking team while identity, endpoint, and SIEM operations are handled elsewhere, which can slow response. Pull version data from the management UI, API, or package metadata and compare it directly to the ranges above instead of relying on memory or build naming conventions.
Technical Notes
If you have shell or console access to the appliance or controller environment, version discovery may look like this depending on deployment method:
show version
Or via API and management tooling where available in your environment:
curl -k -u 'admin:REDACTED' https://avi-controller.example/api/cluster/runtime
If those commands differ in your deployment, use the documented Avi administrative method to retrieve the exact software version and build number, then compare against the affected ranges above.
CVSS Score Breakdown
NVD assigns CVE-2026-47871 a CVSS v3.x base score of 8.8, which puts it in the High severity range. The full vector string was not available in the research note, so some score component details cannot be quoted directly from NVD. What is known from the CVE description is that the attack is performed over the network and requires authentication.
In practical terms, a score of 8.8 suggests a combination of meaningful impact with relatively low exploitation friction once access is obtained. The authenticated requirement lowers broad internet-scale exploitability compared with pre-auth flaws, but high scores remain common when a vulnerability can expose sensitive files, facilitate deeper platform access, or affect critical management infrastructure. Because the exact vector string was not retrieved, defenders should avoid assuming whether the privileges required are low or high, or whether user interaction is needed. In the absence of that data, the safest operational assumption is that any authenticated access to the relevant function could be enough.
A second point on CVSS: do not over-index on the fact that this is “only” post-auth. In enterprise environments, authenticated access is often easier to obtain than many teams expect through credential reuse, stale accounts, VPN compromise, SSO token theft, or abuse of delegated admin roles. For a load balancer and application delivery platform, the blast radius can be materially larger than the raw label suggests.
Exploitation Status
At the time of writing, CISA KEV does not list CVE-2026-47871. That means there is no CISA-confirmed indication, via the KEV catalog, that this CVE is being actively exploited in the wild. The research note also did not identify a ransomware association or a federal remediation deadline tied to KEV status.
Just as important, the available sources did not surface a public proof-of-concept exploit, GitHub exploit repository, or explicit vendor statement confirming active exploitation. That does not mean exploitation is impossible or unlikely; it only means the sources cited here do not confirm it. Defenders should phrase status carefully: no confirmed in-the-wild exploitation was identified in the reviewed sources, and no public PoC was identified in those sources either.
Where this leaves practitioners is a familiar middle ground. You should not wait for a KEV listing or public exploit before acting, especially because authenticated flaws in infrastructure software are often exploitable by internal adversaries or by attackers who already have a foothold. Prioritize based on exposure of the management plane, identity hygiene around Avi accounts, and how quickly your organization can upgrade the platform safely.
How to Detect It
Detection is challenging because the vulnerable endpoint and exact exploitation flow were not disclosed in the source material used here. That means defenders should focus on behavior-based detection around suspicious file path input, unusual authenticated requests to management APIs, and post-auth access patterns from accounts that do not normally perform administrative file operations.
Start with your Avi management logs, reverse proxy logs in front of the controller if applicable, WAF telemetry, and any centralized authentication records. Hunt for authenticated requests containing traversal sequences such as ../, %2e%2e%2f, or backslash-based variants. Also review whether any service accounts, automation identities, or human admin accounts made requests from unusual source IPs immediately before configuration export, backup, file read, or support bundle activity. If you lack visibility into request parameters, focus on anomalous successful responses from management endpoints following failed attempts with encoded path strings.
Technical Notes
A simple search pattern for web or API logs:
(\./|%2e%2e%2f|%252e%252e%252f|\..\|%2e%2e\)
Example Splunk query for suspected traversal attempts against Avi-related logs:
index=netsec OR index=app
("avi" OR "vmware avi" OR "load balancer")
("|" OR "*")
(".." OR "%2e%2e%2f" OR "..\" OR "%252e%252e%252f")
| stats count min(_time) as firstSeen max(_time) as lastSeen by src_ip, user, uri_path, uri_query, http_status
| sort - count
Example Sigma-style logic concept for HTTP logs:
title: Possible Directory Traversal Attempt Against Avi Management Interface
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- "../"
- "%2e%2e%2f"
- "..\"
- "%252e%252e%252f"
condition: selection
level: high
If you have packet inspection or IDS in front of the management plane, a coarse network signature can key on traversal strings in authenticated requests to Avi management hosts. Because the exact endpoint is unknown, anchor detection on destination hostnames or IPs associated with the Avi Controller rather than a single URI path.
Mitigation and Patching
The primary remediation is to upgrade to a fixed release. Based on the cited version data, the specific fixes are:
- Upgrade 32.1.1 to 32.1.2
- Upgrade 31.1.1 through 31.2.2 to 31.2.2-2p3
- Upgrade 30.1.1 through 30.2.6 to 30.2.7
- Upgrade 22.1.1 through 22.1.7 to 30.2.7
That fixed-version mapping should be followed exactly unless Broadcom support has provided a more specific branch recommendation for your deployment. Because load balancers are infrastructure-critical, validate upgrade compatibility with your controller cluster state, service engine versions, and change window requirements before rolling forward. If you are on 22.1.x, note that the available source material points to 30.2.7 as the fix target; confirm platform support and upgrade path requirements in Broadcom documentation before execution.
If you cannot patch immediately, reduce exposure around the management plane. Restrict access to trusted admin networks, enforce MFA on all administrative identities, rotate or disable stale API credentials, and review role assignments for accounts that do not need file-related or broad administrative capabilities. These are compensating controls, not a substitute for upgrading, especially because the flaw is reachable by authenticated network users.
Technical Notes
Use your documented Avi upgrade procedure and obtain the exact fixed build from Broadcom. Because deployment methods vary, a representative administrative workflow may include staging the image and applying the controller upgrade from the management plane. Verify post-upgrade version immediately after maintenance.
Example version verification after upgrade:
show version
Example API-based validation approach:
curl -k -u 'admin:REDACTED' https://avi-controller.example/api/cluster/runtime
Compensating control examples while waiting for maintenance:
# Restrict management interface access at the firewall
# Pseudocode example only; implement in your network policy tool
allow src=<admin_subnets> dst=<avi_controller_mgmt_ip> port=443
deny src=any dst=<avi_controller_mgmt_ip> port=443
Workaround checklist:
1. Limit controller UI/API access to dedicated admin subnets or VPN segments.
2. Enforce MFA for all Avi administrative users.
3. Disable unused local accounts and rotate API tokens.
4. Review recent authenticated requests for traversal patterns.
5. Schedule upgrade to the fixed version for your branch.
Because no vendor-published workaround details were included in the retrievable source text, treat these as standard exposure-reduction measures rather than vendor-certified mitigations.
References
The primary authoritative source for this vulnerability is Broadcom’s VMware security advisory. The advisory is identified as VMSA-2026-0005: VMware Avi Load Balancer addresses multiple vulnerabilities. In the available research, the portal page did not render clean advisory body text, but it is still the authoritative vendor reference tied to this CVE.
A secondary corroborating source is GovCERT.HK Security Alert (A26-07-28): Multiple Vulnerabilities in VMware Avi Load Balancer, which confirms the vendor advisory exists and that patches are available. NVD provides the CVE record, severity, publication date, and affected/fixed version mapping cited throughout this article.
- NVD CVE record: https://nvd.nist.gov/vuln/detail/CVE-2026-47871
- Broadcom advisory: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926
- GovCERT.HK alert: https://www.govcert.gov.hk/en/alerts_detail.php?id=1968
- VMware Security Blog index: https://blogs.vmware.com/security
For defenders, the bottom line is simple: inventory Avi versions now, identify whether any controllers fall into the affected ranges, and move to the listed fixed release as quickly as your change process allows. Even without confirmed public exploitation, a high-severity authenticated traversal flaw in a core application delivery platform deserves near-term remediation.
You can also refer to our articles on best CASB platforms compared and how to do digital forensics on Linux.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.