37926

support.broadcom.com • July 19, 2026

Share: View original

VMSA-2026-0005: VMware Avi Load Balancer addresses multiple vulnerabilities (CVE-2026-47865, CVE-2026-47866, CVE-2026-47867, CVE-2026-47868, CVE-2026-47869, CVE-2026-47870, CVE-2026-47871)

VMware Avi Load Balancer

VMware Avi Load Balancer

CVE-2026-47865, CVE-2026-47866, CVE-2026-47867, CVE-2026-47868, CVE-2026-47869, CVE-2026-47870, CVE-2026-47871

VMware Avi Load Balancer addresses multiple vulnerabilities (CVE-2026-47865, CVE-2026-47866, CVE-2026-47867, CVE-2026-47868, CVE-2026-47869, CVE-2026-47870, CVE-2026-47871)

2026-07-14 (Initial advisory)

CVE-2026-47865, CVE-2026-47866, CVE-2026-47867, CVE-2026-47868, CVE-2026-47869, CVE-2026-47870, CVE-2026-47871

Multiple vulnerabilities in Avi Load Balancer were privately reported to Broadcom. Patches are available to remediate these vulnerabilities in the affected Broadcom product.

Description: VMware Avi Load Balancer contains an authentication bypass vulnerability. Broadcom has evaluated the severity of the issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. Known Attack Vectors: A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism.

Resolution: To remediate CVE-2026-47865 apply the software upgrade to the Avi Controller listed in the 'Fixed Version' column of the 'Response Matrix' found below. Workarounds: None.

Additional Documentation: None.

Acknowledgements: Broadcom would like to thank Filip Waeytens (NATO NCSC) for reporting this issue to us.

Description: VMware Avi Load Balancer contains an authorization bypass vulnerability. Broadcom has evaluated the severity of the issue to be in the Important severity range with a maximum CVSSv3 base score of 8.3. Known Attack Vectors: A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization.

Resolution: To remediate CVE-2026-47866 apply the software upgrade to the Avi Controller listed in the 'Fixed Version' column of the 'Response Matrix' found below. Workarounds: None.

Additional Documentation: None.

Acknowledgements: Broadcom would like to thank Filip Waeytens (NATO NCSC) for reporting this issue to us.

Description: VMware Avi Load Balancer contains a remote code execution vulnerability. Broadcom has evaluated the severity of the issue to be in the Important severity range with a maximum CVSSv3 base score of 8.7. Known Attack Vectors: A malicious user with network access may be able to access the Avi Control plane and execute code remotely.

Resolution: To remediate CVE-2026-47867 apply the software upgrade to the Avi Controller listed in the 'Fixed Version' column of the 'Response Matrix' found below. Workarounds: None.

Additional Documentation: None.

Acknowledgements: Broadcom would like to thank Filip Waeytens (NATO NCSC) for reporting this issue to us.

Description: VMware Avi Load Balancer contains a local privilege escalation vulnerability. Broadcom has evaluated the severity of the issue to be in the Important severity range with a maximum CVSSv3 base score of 7.8. Known Attack Vectors: A malicious user with local access may be able to escalate their privileges to run code as root.

Resolution: To remediate CVE-2026-47868 apply the software upgrade to the Avi Controller listed in the 'Fixed Version' column of the 'Response Matrix' found below. Workarounds: None.

Additional Documentation: None.

Acknowledgements: Broadcom would like to thank Filip Waeytens (NATO NCSC) for reporting this issue to us.

Description: VMware Avi Load Balancer contains a remote code execution vulnerability. Broadcom has evaluated the severity of the issue to be in the Important severity range with a maximum CVSSv3 base score of 8.7. Known Attack Vectors: A malicious authenticated user with network access may be able to inject and execute code.

Resolution: To remediate CVE-2026-47869 apply the software upgrade to the Avi Controller listed in the 'Fixed Version' column of the 'Response Matrix' found below. Workarounds: None.

Additional Documentation: None.

Acknowledgements: Broadcom would like to thank Filip Waeytens (NATO NCSC) and Lang Khuong Duy (Viettel IDC) for reporting this issue to us.

Description: VMware Avi Load Balancer contains a privilege escaltion vulnerability. Broadcom has evaluated the severity of the issue to be in the Important severity range with a maximum CVSSv3 base score of 7.1. Known Attack Vectors: A malicious authenticated user with network access may be able to execute remote code.

Resolution: To remediate CVE-2026-47870 apply the software upgrade to the Avi Controller listed in the 'Fixed Version' column of the 'Response Matrix' found below. Workarounds: None.

Additional Documentation: None.

Acknowledgements: Broadcom would like to thank Lang Khuong Duy (Viettel IDC) for reporting this issue to us.

Description: VMware Avi Load Balancer contains a directory traversal vulnerability. Broadcom has evaluated the severity of the issue to be in the Important severity range with a maximum CVSSv3 base score of 8.8. Known Attack Vectors: Flaws in file path validation allow malicious, authenticated network users to perform directory traversal attacks.

Resolution: To remediate CVE-2026-47871 apply the software upgrade to the Avi Controller listed in the 'Fixed Version' column of the 'Response Matrix' found below. Workarounds: None.

Additional Documentation: None.

Acknowledgements: Broadcom would like to thank Lang Khuong Duy (Viettel IDC) for reporting this issue to us.

VMware Avi Load Balancer

CVE-2026-47866, CVE-2026-47867, CVE-2026-47868, CVE-2026-47869, CVE-2026-47870, CVE-2026-47871

8.3 , 8.7 , 7.8 , 8.7 , 7.1 , 8.8

VMware Avi Load Balancer

CVE-2026-47865, CVE-2026-47866, CVE-2026-47867, CVE-2026-47868, CVE-2026-47869, CVE-2026-47870, CVE-2026-47871

9.8 , 8.3 , 8.7 , 7.8 , 8.7 , 7.1 , 8.8

VMware Avi Load Balancer

CVE-2026-47865, CVE-2026-47866, CVE-2026-47867, CVE-2026-47868, CVE-2026-47869, CVE-2026-47870, CVE-2026-47871

9.8 , 8.3 , 8.7 , 7.8 , 8.7 , 7.1 , 8.8

VMware Avi Load Balancer

CVE-2026-47865, CVE-2026-47866, CVE-2026-47867, CVE-2026-47868, CVE-2026-47869, CVE-2026-47870, CVE-2026-47871

9.8 , 8.3 , 8.7 , 7.8 , 8.7 , 7.1 , 8.8

[1] VMware Avi Load Balancer 32.1.2 is the recommended version, which is also the most recent version currently available. 4. References:

Fixed Version(s) and Release Notes:

VMware Avi Load Balancer 32.1.2

VMware Avi Load Balancer 31.2.2-2-p3

VMware Avi Load Balancer 30.2.7

Additional Documentation:

Version 22.1.x must be upgraded to at least 30.2.7 or later.

Mitre CVE Dictionary Links:

FIRST CVSSv3 Calculator:

2026-07-14 : VMSA-2026-0005 Initial security advisory.

E-mail: [email protected] PGP key VMware Security Advisories VMware External Vulnerability Response and Remediation Policy VMware Lifecycle Support Phases VMware Security Blog X

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in BeyondTrust Software Requires Immediate Patching BeyondTrust has issued a warning regarding a critical remote code execution (RCE) vulnerability in its Remote Support and Privileged Remote Access software. The flaw, tracked as CVE-2026-1731, allows unauthenticated attackers to execute arbitrary code remotely and affects versions 25.3.1 or earlier of Remote Support and 24.3.4 or earlier of Privileged Remote Access. Users are advised to apply the patches released on February 6, 2026, to mitigate the risk of exploitation. 860 sources 67

Extracted Entities

CVEs (7)

CVE-2026-47865 CVE-2026-47866 CVE-2026-47867 CVE-2026-47868 CVE-2026-47869 CVE-2026-47870 CVE-2026-47871

CWE Weaknesses (4)

CWE-22 - Path Traversal CWE-269 - Improper Privilege Management CWE-287 - Improper Authentication CWE-862 - Missing Authorization

Tools (1)