EUVD-2026-45364
GHSA-h452-q2fr-5rvh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Management interface is network-accessible with no special conditions; low-privileged account sufficient; RCE yields full C/I/A impact with no scope change.
Primary rating from Vendor (vmware).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute code.
Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)
Articles & Coverage 1
AnalysisAI
Remote code execution in VMware Avi Load Balancer exposes organizations running versions from 22.1.1 through 32.1.1 to arbitrary code injection by low-privileged authenticated users with network access. The flaw is classified as CWE-94 code injection, meaning attacker-supplied input reaches an execution context without adequate sanitization. Broadcom has released patches across all affected branches; no public exploit code has been identified at time of analysis, and the EPSS score of 0.68% (48th percentile) reflects modest current exploitation probability despite the high CVSS 8.8 rating.
Technical ContextAI
VMware Avi Load Balancer (CPE: cpe:2.3:a:vmware:avi_load_balancer) is a software-defined application delivery controller and load balancing platform, now under Broadcom ownership. The root cause is CWE-94 (Improper Control of Generation of Code), indicating that user-supplied input is passed to a code evaluation mechanism - such as a scripting engine, template renderer, expression evaluator, or policy configuration interface - without sufficient sanitization or sandboxing. This is distinct from memory-corruption-based RCE: the attacker does not need to subvert memory layout but instead abuses a legitimate code-evaluation pathway exposed to authenticated users. The CVSS vector (AV:N/AC:L/PR:L) confirms the vulnerable component is reachable over the network and does not require elevated privileges, suggesting the injection point is accessible through a standard user-facing API or management interface.
RemediationAI
Upgrade VMware Avi Load Balancer to the appropriate patched release for your branch: 32.1.2 for the 32.x line, 31.2.2-2p3 for the 31.x line, or 30.2.7 for both the 30.x and 22.x lines. Patch details are confirmed in the Broadcom advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926. As compensating controls for environments where immediate patching is not feasible: restrict access to the Avi Load Balancer management and API interfaces to trusted internal subnets or VPN-only segments, reducing the effective AV:N exposure to a narrower attack surface; audit and minimize the number of accounts with any level of authenticated access to the platform, since PR:L means any valid account is sufficient for exploitation; and enable enhanced logging on the management interface to detect anomalous API activity that could indicate exploitation attempts. Network restriction does not eliminate the vulnerability but materially reduces exposure, while account reduction shrinks the attacker's available credential pool.
More in Avi Load Balancer
View allAuthentication bypass in VMware Avi Load Balancer (versions 22.1.1-22.1.7, 30.1.1-30.2.6, and 31.1.1-31.2.2) lets a netw
Directory traversal in VMware Avi Load Balancer (formerly Avi Networks NSX Advanced Load Balancer) lets authenticated ne
Remote code execution in VMware Avi Load Balancer exposes the Avi Control Plane to arbitrary code execution by any low-p
Privilege escalation in VMware Avi Load Balancer exposes authenticated, network-accessible users to remote code executio
Authorization bypass in VMware Avi Load Balancer (branches 22.1.x, 30.x, 31.x, and 32.1.1) allows a network-based actor
Local privilege escalation in VMware (Broadcom) Avi Load Balancer allows a user who already has local access to the appl
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today