Avi Load Balancer CVE-2026-47866

Exploitation requires network reachability to the Avi Load Balancer Control Plane and a valid low-privilege authenticated principal (CVSS PR:L) - this is an authorization bypass that escalates access for an already-authenticated actor, not an unauthenticated remote compromise. The affected surface is explicitly 'a limited subset of the Avi Control Plane,' so an attacker can only reach the specific functions left unguarded by the flawed authorization check, not the entire Control Plane. Limiting factors that reduce realistic risk: the attacker must first hold credentials/an account with some access, must have network line-of-sight to the Control Plane (often segmented onto a management network), and must be running an affected build (22.1.1-22.1.7, 30.1.1-30.2.6, 31.1.1-31.2.2, or 32.1.1). No user interaction is required (UI:N).

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, score 8.3) indicates a network-reachable, low-complexity attack requiring low privileges and no user interaction, with high confidentiality and integrity impact but only low availability impact. The most important qualifier is PR:L: this is not an unauthenticated internet drive-by - the attacker needs a valid low-privilege account or foothold with network reach to the Control Plane, which meaningfully narrows the realistic threat population to insiders, compromised low-tier accounts, or attackers who have already breached the management network. No EPSS score, KEV entry, POC, or SSVC decision data was supplied, so probabilistic and observed-exploitation signals are unavailable and cannot be weighed. There is a notable internal tension to flag: the description characterizes access as 'a limited subset of the Avi Control Plane,' yet the vendor vector assigns C:H and I:H - verify with Broadcom whether the exposed subset truly permits high-impact confidentiality/integrity effects, as 'limited subset' language can imply a narrower blast radius than C:H/I:H suggests. Overall this is a genuine but access-gated priority: high-value because the Control Plane governs load-balancing policy, but bounded by the low-privilege prerequisite.

An attacker who has obtained a low-privilege Avi account (for example via credential phishing, a reused password, or lateral movement onto the management network) sends authenticated requests to the Avi Control Plane and, because of the broken authorization check, reaches configuration or data-plane management functions their role should not permit. Given AV:N and AC:L, no special timing or user interaction is needed once network access and credentials are in hand; no public POC is currently identified, so an attacker would need to discover or reverse-engineer the specific unprotected endpoints.