What is the CVSS score of CVE-2026-47871?

CVE-2026-47871 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of Avi Load Balancer are affected by CVE-2026-47871?

VMware Avi Load Balancer contains a directory traversal vulnerability affecting authenticated users that enables unauthorized file access and potential modification of sensitive system files on this…

How to fix or mitigate CVE-2026-47871?

Within 24 hours, audit all authenticated user accounts with access to VMware Avi Load Balancer and disable unnecessary administrative accounts; implement firewall or network segmentation rules restricting access to essential personnel via on-site or VPN-only connections. Over the next 7 days, enable all available audit logging within Avi, configure alerting for suspicious file access patterns, deploy file integrity monitoring on the appliance to detect unauthorized modifications, and inventory all certificates and credentials currently managed by the system. Within 30 days, escalate contact with VMware to confirm patch availability and timelines; conduct a business continuity assessment to determine whether replacement with an alternative load balancer is warranted; and establish a contingency isolation or failover plan if patches remain unavailable beyond 90 days.

Avi Load Balancer CVE-2026-47871

EUVD-2026-45366 HIGH

Path Traversal (CWE-22)

2026-07-18 vmware

GHSA-m658-jv2r-hm53

Path Traversal VMware Avi Load Balancer

8.8

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 18, 2026 - 09:34 vuln.today

CVE Published

Jul 18, 2026 - 08:57 cve.org

HIGH 8.8

DescriptionCVE.org

VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform directory traversal attacks.

Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

Articles & Coverage 1

News 7 New VMware Vulnerabilities - 1 Critical, 6 High Severity Jul 19, 2026

AnalysisAI

Directory traversal in VMware Avi Load Balancer (formerly Avi Networks NSX Advanced Load Balancer) lets authenticated network users bypass file path validation to reach files outside intended directories. Rated CVSS 8.8, the flaw is exploitable remotely by any authenticated user (PR:L) and the vendor scores full high confidentiality, integrity, and availability impact, implying potential arbitrary file read and/or write on the appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.