EUVD-2026-45362
GHSA-cf92-7pc6-48mm
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Network-reachable control plane (AV:N) with low-complexity injection (AC:L) but requires high-privilege operator access (PR:H); Controller RCE crosses scope (S:C) and realistically threatens availability, so A:H.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi Control plane and execute code remotely.
Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)
Articles & Coverage 1
AnalysisAI
Remote code execution in VMware (Broadcom) Avi Load Balancer allows a network-adjacent, high-privileged user to reach the Avi Control plane and run arbitrary code, per Broadcom advisory 0/37926. The flaw is a CWE-94 code injection carrying a CVSS 3.1 score of 8.7 with a changed scope, meaning a control-plane compromise can cascade beyond the immediately vulnerable component. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold high privileges on the Avi Control plane (CVSS PR:H) and to have network access to the Avi Controller management/API interface; no user interaction is needed (UI:N) and attack complexity is low (AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N scores 8.7 (High): network reachable, low complexity, no user interaction, but requiring high privileges (PR:H) - i.e., an already-authenticated, privileged Control-plane user rather than an anonymous attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a privileged Avi Controller account - through credential theft, a malicious insider, or reuse of leaked operator credentials - reaches the Control-plane management interface over the network and submits crafted input that the Controller processes as code (CWE-94), gaining arbitrary code execution on the Controller. From there the attacker can pivot to managed Service Engines and manipulate or intercept load-balanced traffic. … |
| Remediation | Upgrade to the fixed release for your branch: Vendor-released patch: 32.1.2 for the 32.1.x line; 31.2.2-2p3 for the 31.1.1-31.2.2 range; 30.2.7 for the 30.1.1-30.2.6 range; and 30.2.7 (a cross-branch upgrade) for the 22.1.1-22.1.7 range. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Avi Load Balancer instances, identify management planes with network accessibility from untrusted segments, and implement emergency network segmentation to restrict control plane access to authorized administrative subnets only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Avi Load Balancer
View allAuthentication bypass in VMware Avi Load Balancer (versions 22.1.1-22.1.7, 30.1.1-30.2.6, and 31.1.1-31.2.2) lets a netw
Directory traversal in VMware Avi Load Balancer (formerly Avi Networks NSX Advanced Load Balancer) lets authenticated ne
Remote code execution in VMware Avi Load Balancer (versions 22.1.x, 30.1.x/30.2.x, 31.1.x/31.2.x, and 32.1.1) allows an
Authorization bypass in VMware Avi Load Balancer (branches 22.1.x, 30.x, 31.x, and 32.1.1) allows a network-based actor
Local privilege escalation in VMware (Broadcom) Avi Load Balancer allows a user who already has local access to the appl
Privilege escalation leading to remote code execution in VMware (Broadcom) Avi Load Balancer allows an authenticated use
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today