What is the CVSS score of CVE-2026-47867?

CVE-2026-47867 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of VMware Avi Load Balancer are affected by CVE-2026-47867?

VMware Avi Load Balancer deployments running versions 22.1.1-32.1.1 face remote code execution exposure where authenticated low-privilege users can assume complete control of the control plane,…

How to fix or mitigate CVE-2026-47867?

Within 24 hours, inventory all VMware Avi Load Balancer deployments and confirm affected versions (22.1.1 through 32.1.1), prioritizing systems where control planes are accessible to authenticated low-privilege network users. No public exploit identified at time of analysis; however, CVSS 8.8 severity with complete impact across confidentiality, integrity, and availability makes this urgent. Within 7 days, apply vendor-released patches across all affected major version branches after validation in staging environments to ensure load balancer operational stability. Within 30 days, complete patching across all instances, confirm remediation using vendor compliance tools, and implement network segmentation restricting control plane access to authorized administrative networks only.

VMware Avi Load Balancer CVE-2026-47867

EUVD-2026-45362 HIGH

Code Injection (CWE-94)

2026-07-18 vmware

GHSA-cf92-7pc6-48mm

RCE Code Injection VMware Avi Load Balancer

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (vmware) PRIMARY

HIGH

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-accessible control plane requires only low-privilege auth (PR:L); code injection grants full C/I/A impact with no scope change beyond the controller.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 20, 2026 - 19:34 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 20, 2026 - 19:22 vuln.today

cvss_changed

CVSS changed

Aug 20, 2026 - 19:22 NVD

8.7 (HIGH) 8.8 (HIGH)

Analysis Generated

Jul 18, 2026 - 09:31 vuln.today

CVE Published

Jul 18, 2026 - 08:57 cve.org

HIGH 8.7

DescriptionNVD

VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi Control plane and execute code remotely.

Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

Articles & Coverage 1

News 7 New VMware Vulnerabilities - 1 Critical, 6 High Severity Jul 19, 2026

AnalysisAI

Remote code execution in VMware Avi Load Balancer exposes the Avi Control Plane to arbitrary code execution by any low-privileged, network-connected user, stemming from a code injection flaw (CWE-94) in the controller. Multiple major version branches from 22.1.1 through 32.1.1 are confirmed affected, with vendor-released patches available across all branches. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 rating and full high-impact triad (C:H/I:H/A:H) make this a high-priority patch target for any deployment where the control plane is network-reachable.

Technical ContextAI

VMware Avi Load Balancer (also marketed as NSX Advanced Load Balancer) is an enterprise application delivery controller whose centralized Avi Controller serves as the management and orchestration plane for all load balancing policy, health monitoring, and traffic steering. CWE-94 (Improper Control of Generation of Code - Code Injection) identifies the root cause as insufficient neutralization of user-supplied input that is subsequently interpreted and executed as code by the control plane process. This class of flaw typically manifests in templating engines, scripting interfaces, or dynamic evaluation constructs that fail to sanitize attacker-controlled strings. The affected CPE is cpe:2.3:a:vmware:avi_load_balancer:*:*:*:*:*:*:*:*, spanning four distinct version branches across a multi-year release history. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) confirms network-reachable, low-complexity exploitation requiring only a low-privilege authenticated session with no scope change.

RemediationAI

Upgrade to vendor-released patched versions as follows: deployments running 32.1.1 should upgrade to 32.1.2; deployments running 31.1.1 through 31.2.2 should upgrade to 31.2.2-2p3; deployments running 30.1.1 through 30.2.6 or any 22.1.x release should upgrade to 30.2.7. Full patch guidance is available in the Broadcom security advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926. Where immediate patching is not feasible, restrict network access to the Avi Controller management interface using firewall rules or network ACLs, limiting reachability to only trusted management jump hosts or dedicated management VLANs - this directly addresses the AV:N attack vector and reduces the exploitable population to accounts on the management network. Note that this compensating control does not eliminate the vulnerability and privileged insiders or compromised management hosts remain a threat vector; it is not a substitute for patching.