VMware Avi Load Balancer: Critical vulnerability allows bypassing login

In VMware's Avi Load Balancer, developers have fixed several security vulnerabilities. Some have critical risk ratings and allow attackers to bypass authentication, among other things.

Broadcom warns in a security advisory the vulnerabilities. The most serious vulnerability allows malicious actors with network access to the Avi Controller interface to bypass the authentication mechanism (CVE-2026-47865, CVSS 9.8 , Risk “ critical ”). However, Broadcom does not elaborate on how exactly they can do this or where the error lies. A directory traversal vulnerability (CVE-2026-47871, CVSS 8.8 , Risk “ high ”) threatens the load balancer's security, as does a code injection vulnerability in the Avi Controller (CVE-2026-47867, CVSS 8.7 , Risk “ high ”). Logged-in users can also inject and execute malicious code in a non-detailed way (CVE-2026-47869, CVSS 8.7 , Risk “ high ”).

Furthermore, attackers can gain unauthorized access to some settings in the Avi Controller (CVE-2026-47866, CVSS 8.3 , Risk “ high ”). Users with local access can also escalate their privileges and execute code as a root user (CVE-2026-47868, CVSS 7.8 , Risk “ high ”). This is also possible for malicious logged-in users from the network (CVE-2026-47870, CVSS 7.1 , Risk “ high ”).

Broadcom's developers are providing updates in several development branches. The vulnerabilities are fixed in VMware Avi Load Balancer versions 32.1.2, 31.2.2-2p3, and 30.2.7. Those still using the vulnerable versions 22.1.1 to 22.1.7 should migrate to 30.2.7.

In early June, Broadcom reported several cross-site scripting vulnerabilities in VMware Cloud Foundation and other products . However, they only reached the “high” risk rating. To fix them, developers released updated software.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.