EUVD-2026-45365
GHSA-x69w-rh5r-3wgj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Management interface is network-exposed requiring only low-privilege credentials; full CIA impact reflects demonstrated RCE capability from privilege escalation with no scope change.
Primary rating from Vendor (vmware).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to execute remote code.
Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)
Articles & Coverage 1
AnalysisAI
Privilege escalation in VMware Avi Load Balancer exposes authenticated, network-accessible users to remote code execution across a wide version range spanning 22.1.x through 32.1.x. The CVSS 8.8 rating reflects low-complexity, low-privilege network exploitation yielding full confidentiality, integrity, and availability impact on affected systems. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS at 0.39% (31st percentile) confirms limited active exploitation pressure at time of analysis.
Technical ContextAI
VMware Avi Load Balancer (CPE: cpe:2.3:a:vmware:avi_load_balancer:*:*:*:*:*:*:*:*) is a software-defined application delivery controller providing load balancing, WAF, and analytics capabilities, now maintained under Broadcom following the VMware acquisition. The root cause is CWE-269 (Improper Privilege Management), meaning the platform insufficiently enforces privilege boundaries - a principal holding low-privilege credentials can traverse into higher-privilege execution contexts sufficient to run arbitrary code. The AV:N vector indicates the vulnerable privilege escalation path is reachable via the network-exposed management or API plane, not confined to local OS-level access.
RemediationAI
The primary fix is to upgrade to a patched release per the Broadcom advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926: upgrade to 32.1.2 if running 32.1.1; upgrade to 31.2.2-2p3 if running 31.1.1-31.2.2; upgrade to 30.2.7 if running 30.1.1-30.2.6 or 22.1.1-22.1.7. Where immediate patching is not feasible, restrict network access to the Avi Load Balancer management and API interfaces to trusted administrative subnets or VPN segments, reducing the effective attack surface - note this does not eliminate risk if insider-threat scenarios apply. Audit all platform accounts and revoke or demote any unnecessary low-privilege accounts, since PR:L is the prerequisite for exploitation. Enforcing MFA for all platform logins further raises the bar for credential-based access. These compensating controls reduce but do not eliminate risk and should not substitute for patching.
More in Avi Load Balancer
View allAuthentication bypass in VMware Avi Load Balancer (versions 22.1.1-22.1.7, 30.1.1-30.2.6, and 31.1.1-31.2.2) lets a netw
Directory traversal in VMware Avi Load Balancer (formerly Avi Networks NSX Advanced Load Balancer) lets authenticated ne
Remote code execution in VMware Avi Load Balancer exposes organizations running versions from 22.1.1 through 32.1.1 to a
Remote code execution in VMware Avi Load Balancer exposes the Avi Control Plane to arbitrary code execution by any low-p
Authorization bypass in VMware Avi Load Balancer (branches 22.1.x, 30.x, 31.x, and 32.1.1) allows a network-based actor
Local privilege escalation in VMware (Broadcom) Avi Load Balancer allows a user who already has local access to the appl
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today