CVE-2026-47865
Full vulnerability record from the local CVENow database.
Description
VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism. Affected versions: 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)
Severity
CRITICAL
CVSS score
9.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-18 09:17:08.287000
Last modified
2026-10-24 20:10:00.137000
View original CVE JSON
{
"id": "CVE-2026-47865",
"sourceIdentifier": "[email protected]",
"published": "2026-07-18T09:17:08.287",
"lastModified": "2026-10-24T20:10:00.137",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism.\n\nAffected versions:\n31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)\n30.1.1 through 30.2.6 (fixed in 30.2.7)\n22.1.1 through 22.1.7 (fixed in 30.2.7)"
},
{
"lang": "es",
"value": "VMware Avi Load Balancer contiene una vulnerabilidad de omisión de autenticación. Un usuario malintencionado con acceso a la red podría acceder al plano de control de Avi al omitir el mecanismo de autenticación.\n\nVersiones afectadas:\n31.1.1 hasta 31.2.2 (corregido en 31.2.2-2p3)\n30.1.1 hasta 30.2.6 (corregido en 30.2.7)\n22.1.1 hasta 22.1.7 (corregido en 30.2.7)"
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "VMware",
"product": "Avi Load Balancer",
"defaultStatus": "unaffected",
"versions": [
{
"version": "31.1.1",
"lessThanOrEqual": "31.2.2",
"versionType": "custom",
"status": "affected"
},
{
"version": "30.1.1",
"lessThanOrEqual": "30.2.6",
"versionType": "custom",
"status": "affected"
},
{
"version": "22.1.1",
"lessThanOrEqual": "22.1.7",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-22T00:00:00+00:00",
"id": "CVE-2026-47865",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:*:*:*:*:*:*:*:*",
"versionStartIncluding": "22.1.1",
"versionEndExcluding": "22.1.7",
"matchCriteriaId": "C16EB155-2D4A-424B-8A72-4E50A67A6829"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:*:*:*:*:*:*:*:*",
"versionStartIncluding": "30.1.1",
"versionEndExcluding": "30.2.7",
"matchCriteriaId": "3E9EADC5-BEE0-411D-8BA5-62EC1847D834"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:*:*:*:*:*:*:*:*",
"versionStartIncluding": "31.1.1",
"versionEndExcluding": "31.2.2",
"matchCriteriaId": "3961AB50-8B9B-474D-8B25-F039F94BE703"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:-:*:*:*:*:*:*",
"matchCriteriaId": "B63F0768-E630-4297-A234-500C318518E6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p10:*:*:*:*:*:*",
"matchCriteriaId": "E839116E-4E12-45F9-901D-90319F474A23"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p11:*:*:*:*:*:*",
"matchCriteriaId": "7E148E4F-CDD6-4DBE-91E4-A39B01C9B365"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p2:*:*:*:*:*:*",
"matchCriteriaId": "7EBDE544-5130-4CD0-9A45-F06A1CEC5B11"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p3:*:*:*:*:*:*",
"matchCriteriaId": "03DA9160-FB74-4366-B303-E3A5AC744B06"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p4:*:*:*:*:*:*",
"matchCriteriaId": "D3C62974-8984-477C-A5E1-7268A455B6EC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p5:*:*:*:*:*:*",
"matchCriteriaId": "77750255-FE07-466F-86F3-A134297F4357"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p6:*:*:*:*:*:*",
"matchCriteriaId": "7ED57212-C3BE-4EE2-8CA0-9ADC2A85F4F7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p7:*:*:*:*:*:*",
"matchCriteriaId": "2A7F4A76-A2AF-4303-9B30-47514597DBE2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p8:*:*:*:*:*:*",
"matchCriteriaId": "D6BB02B4-FB9C-4E37-A185-851ECBE14B26"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p9:*:*:*:*:*:*",
"matchCriteriaId": "3D242621-EE9C-4F15-B44D-C2AA3361695B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:31.2.2:-:*:*:*:*:*:*",
"matchCriteriaId": "59DAB0A9-D0C2-465B-ADE0-9BB64DA9CB8D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:31.2.2:2p1:*:*:*:*:*:*",
"matchCriteriaId": "83F16554-7961-4AFC-8324-E6FDE01A0BAF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:31.2.2:2p2:*:*:*:*:*:*",
"matchCriteriaId": "FD6ACD46-BBF6-4900-92C4-F4C77B979CF4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:32.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9B1FF054-1986-4182-821B-93C0D8ABE41F"
}
]
}
]
}
],
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}