VMware Avi Load Balancer CVE-2026-47867

Exploitation requires a valid user account with at minimum low-level privileges on the VMware Avi Load Balancer, as confirmed by the CVSS PR:L metric. The attacker must also have network-level access to the Avi Controller (Control Plane) endpoint. The CVE description does not specify a non-default configuration, a particular feature toggle, or a specific deployment mode as a prerequisite - the vulnerability appears to reside in functionality broadly accessible to authenticated users of the control plane. Key factors limiting exploitation are: (1) authentication is required - unauthenticated remote exploitation is not supported by the CVSS vector (PR:L, not PR:N); (2) the Avi Controller must be network-reachable from the attacker's position - environments that restrict control plane access to dedicated management networks substantially reduce exposure; (3) no specific OS platform, cloud provider, or optional feature configuration is identified as a prerequisite beyond possessing a valid credential. Exploitation is not constrained to any particular version of the underlying OS or hypervisor platform per available data.

The CVSS 8.8 High score reflects a genuinely dangerous primitive: network-accessible code injection on a load balancer control plane yields full C:H/I:H/A:H impact. Control plane compromise translates to the ability to reroute, intercept, or disrupt all application traffic managed by the controller, making this a high-blast-radius vulnerability in environments where Avi manages critical workloads. The EPSS score of 0.68% (48th percentile) is notably low relative to the CVSS severity - this likely reflects the vulnerability's recency and the absence of published exploit code rather than inherent difficulty, as the AC:L rating suggests exploitation is straightforward for anyone with credentials. No CISA KEV listing is present and no POC has been identified, meaning widespread automated exploitation has not been observed. The PR:L requirement is the primary real-world limiting factor: unauthenticated mass exploitation is not indicated. Environments that properly segment the Avi Controller to a management-only VLAN significantly reduce their attack surface. Organizations should treat this as high priority for patching but not as an imminent zero-day emergency in well-segmented environments.

An attacker holding a low-privileged Avi Load Balancer account - obtained via credential stuffing, phishing, or a compromised internal workstation - sends a crafted API request to the Avi Controller containing a code injection payload. The control plane processes the malformed input without adequate sanitization, causing the injected code to execute under the controller process context, granting the attacker the ability to modify load balancing rules, intercept decrypted traffic, pivot to backend systems, or achieve persistent access. No public exploit code has been identified, but the AC:L rating indicates the exploitation technique is not complex once valid credentials and network access are in hand.