What is the CVSS score of CVE-2026-47866?

CVE-2026-47866 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.4%.

Which versions of Avi Load Balancer are affected by CVE-2026-47866?

VMware Avi Load Balancer versions 22.1.x through 32.1.1 expose a critical authorization flaw that allows network-based users with low-privilege credentials to bypass access controls on…

How to fix or mitigate CVE-2026-47866?

Within 24 hours, inventory all VMware Avi Load Balancer deployments to identify affected versions (22.1.x, 30.x, 31.x, 32.1.1) and document their network isolation status. Within 7 days, restrict network access to the Avi Control Plane to trusted administrator networks only, implement comprehensive audit logging on all control-plane API access, and enforce multi-factor authentication with least-privilege credential policies across administrative accounts. Within 30 days, test and plan migration to an unaffected version (33.x or later); establish upgrade timeline for deployment within 90 days, with interim network segmentation enforced until completion.

Avi Load Balancer CVE-2026-47866

EUVD-2026-45361 HIGH

Incorrect Authorization (CWE-863)

2026-07-18 vmware

GHSA-7hx5-4268-25qv

Authentication Bypass VMware Avi Load Balancer

8.3

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

7.6 HIGH

PR:L reflects the required low-privilege account; AV:N/AC:L/UI:N match a network authorization bypass; I lowered I to L because access is described as a 'limited subset,' though C:H is retained conservatively.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 18, 2026 - 09:30 vuln.today

CVE Published

Jul 18, 2026 - 08:57 cve.org

HIGH 8.3

DescriptionCVE.org

VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization.

Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

Articles & Coverage 1

News 7 New VMware Vulnerabilities - 1 Critical, 6 High Severity Jul 19, 2026

AnalysisAI

Authorization bypass in VMware Avi Load Balancer (branches 22.1.x, 30.x, 31.x, and 32.1.1) allows a network-based actor holding low-privilege credentials to reach a limited subset of the Avi Control Plane without proper authorization. Rated CVSS 8.3 by VMware/Broadcom with CWE-863 (Incorrect Authorization), the flaw exposes control-plane functionality that should be gated behind higher authorization. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical rather than observed.

Technical ContextAI

The affected component is the Avi Load Balancer Control Plane (formerly Avi Networks / VMware NSX Advanced Load Balancer), the management and orchestration tier of VMware's software-defined application delivery controller that handles configuration, policy, telemetry, and lifecycle management for the data-plane Service Engines. The single affected CPE is cpe:2.3:a:vmware:avi_load_balancer, spanning multiple release trains. The root cause is CWE-863 (Incorrect Authorization): the Control Plane performs an authorization check that is missing or incorrectly enforced for a subset of functionality, so an authenticated principal can access resources or operations outside the scope its role should permit. This is an authorization (broken access control) defect rather than an authentication bypass - the CVSS vector's PR:L confirms the attacker must already hold some level of access before escalating to unauthorized functions.

RemediationAI

Apply the vendor-released patches for your branch: upgrade 32.1.1 to 32.1.2, upgrade the 31.1.1-31.2.2 range to 31.2.2-2p3, upgrade the 30.1.1-30.2.6 range to 30.2.7, and migrate the 22.1.1-22.1.7 range to 30.2.7 as indicated in the advisory (confirm the exact 22.1.x target build with Broadcom, as mapping a 22.1 branch to a 30.2.7 fix is unusual and should be validated before scheduling). Consult the Broadcom advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926 for build specifics. Because exploitation requires network reach plus a low-privilege account, effective compensating controls until patching are: restrict Control Plane management-interface access to a dedicated management network or bastion (ACLs/firewall rules limiting who can reach the Control Plane API/UI), which reduces exposure but may disrupt automation or remote admin workflows; tighten and audit low-privilege account provisioning and rotate/scope down credentials, accepting the operational overhead of stricter RBAC; and increase monitoring of Control Plane API access for anomalous cross-role actions, which detects but does not prevent abuse.