EUVD-2026-45365
GHSA-x69w-rh5r-3wgj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Network-reachable, low-complexity, requires a low-privileged authenticated account (PR:L); described RCE implies full compromise, so I set C/I/A:H, higher than the vendor's I:N/A:L.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to execute remote code.
Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)
Articles & Coverage 1
AnalysisAI
Privilege escalation leading to remote code execution in VMware (Broadcom) Avi Load Balancer allows an authenticated user with network access to elevate privileges and run arbitrary code on the appliance. The flaw affects the 22.1.x, 30.x, 31.x and 32.1.x branches and is resolved in vendor-released builds. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated Avi Load Balancer account with network access to the controller (CVSS PR:L), so this is not exploitable pre-authentication - the attacker must already possess or obtain low-privileged credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, base 7.1) indicates a network-reachable, low-complexity attack requiring only low-level authentication and no user interaction, which favors exploitability by any legitimate low-privileged user. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged user with a valid Avi Load Balancer account (for example, a limited tenant operator or a compromised read-only credential) authenticates to the controller over the network and abuses the privilege-management flaw to escalate their role and execute arbitrary commands on the appliance. Because attack complexity is low and no user interaction is needed, a single valid low-tier credential is sufficient; no public POC is currently known. |
| Remediation | Apply the vendor-released fixed builds for your branch: upgrade 32.1.x to 32.1.2, 31.1.1-31.2.2 to 31.2.2-2p3, 30.1.1-30.2.6 to 30.2.7, and 22.1.1-22.1.7 to the 30.2.7 patched line, per the Broadcom advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Avi Load Balancer instances running versions 22.1.x, 30.x, 31.x, or 32.1.x; immediately restrict network management access to these appliances to trusted administrative IP ranges only and audit current user account assignments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Avi Load Balancer
View allAuthentication bypass in VMware Avi Load Balancer (versions 22.1.1-22.1.7, 30.1.1-30.2.6, and 31.1.1-31.2.2) lets a netw
Directory traversal in VMware Avi Load Balancer (formerly Avi Networks NSX Advanced Load Balancer) lets authenticated ne
Remote code execution in VMware Avi Load Balancer (versions 22.1.x, 30.1.x/30.2.x, 31.1.x/31.2.x, and 32.1.1) allows an
Remote code execution in VMware (Broadcom) Avi Load Balancer allows a network-adjacent, high-privileged user to reach th
Authorization bypass in VMware Avi Load Balancer (branches 22.1.x, 30.x, 31.x, and 32.1.1) allows a network-based actor
Local privilege escalation in VMware (Broadcom) Avi Load Balancer allows a user who already has local access to the appl
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today