VMware Avi Load Balancer CVE-2026-47870

Exploitation requires possession of a valid low-privilege authenticated account on the VMware Avi Load Balancer platform, per the CVSS PR:L metric. Network-level access to the management or API interface is necessary (AV:N). No user interaction from a third party is required (UI:N), and no special non-default configuration is indicated in available data. Factors that limit exploitation: unauthenticated external attackers cannot exploit this directly; organizations enforcing MFA, restricting management-interface network exposure, and auditing account provisioning materially reduce the realistic attacker population. The specific internal feature, API endpoint, or configuration path that exposes the privilege boundary is not disclosed in public advisories.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) places this in the high-severity tier: network-reachable, no complexity barrier, no user interaction, and full system compromise upon success. Contrasting signals materially temper urgency: EPSS of 0.39% sits at the 31st percentile, strongly suggesting no automated or widespread exploitation campaign has emerged, and CISA KEV absence corroborates this. The PR:L requirement - a valid, low-privilege account - is the primary real-world gating factor; environments with strict credential hygiene, MFA enforcement, and management-interface network segmentation face substantially reduced exposure. The extremely broad affected version range (22.1.1 through 32.1.1) increases organizational footprint risk, as many deployments may be running unsupported or long-unpatched versions. Overall: patch promptly but this is not an emergency requiring weekend response absent specific threat intelligence of targeting.

An attacker holding a valid low-privilege account - obtained through credential stuffing, phishing, or insider access - connects to the Avi Load Balancer management interface over the network and submits crafted API or management-plane requests that exploit the improper privilege management flaw. With escalated privileges, the attacker executes arbitrary code on the load balancer host, gaining a foothold from which they could manipulate traffic routing, intercept application data, or pivot toward backend infrastructure. No public exploit code has been identified at time of analysis, though the low attack complexity rating implies the escalation path is straightforward once credentials are in hand.