CVE-2026-47865

Name of the Vulnerable Software and Affected Versions VMware Avi Load Balancer versions 31.1.1 through 31.2.2 VMware Avi Load Balancer versions 30.1.1 through 30.2.6 VMware Avi Load Balancer versions 22.1.1 through 22.1.7

Description An authentication bypass exists in the Avi Controller (control plane) due to an authentication and authorization logic flaw. This improper authentication fails to correctly enforce identity checks before granting access to the control plane. A malicious user with network access can remotely exploit this by sending crafted requests to bypass the authentication mechanism without valid credentials. Successful exploitation allows unauthorized access to management interfaces, potentially leading to full compromise of the load balancer management plane, configuration takeover, and service disruption.

Recommendations Update versions 31.1.1 through 31.2.2 to 31.2.2-2p3. Update versions 30.1.1 through 30.2.6 to 30.2.7. Update versions 22.1.1 through 22.1.7 to 30.2.7.