Avi Load Balancer CVE-2026-47871

VMware Avi Load Balancer contains a directory traversal vulnerability affecting authenticated users that enables unauthorized file access and potential modification of sensitive system files on this critical network appliance. With no patch currently available, any user with administrative credentials-including network operators, engineers, or contractors-can exploit this flaw to read or modify configuration data, SSL certificates, and stored credentials protecting downstream services. This creates immediate risk of service disruption, credential exposure, and lateral movement into the wider network.

Within 24 hours, audit all authenticated user accounts with access to VMware Avi Load Balancer and disable unnecessary administrative accounts; implement firewall or network segmentation rules restricting access to essential personnel via on-site or VPN-only connections. Over the next 7 days, enable all available audit logging within Avi, configure alerting for suspicious file access patterns, deploy file integrity monitoring on the appliance to detect unauthorized modifications, and inventory all certificates and credentials currently managed by the system. Within 30 days, escalate contact with VMware to confirm patch availability and timelines; conduct a business continuity assessment to determine whether replacement with an alternative load balancer is warranted; and establish a contingency isolation or failover plan if patches remain unavailable beyond 90 days.

No vendor-released patch identified at time of analysis. Interim mitigations: restrict administrative access via firewall rules or VPN requirement; enforce multi-factor authentication for all accounts accessing the load balancer; implement file integrity monitoring to detect unauthorized read/write operations; maintain encrypted offline backups of all certificates and credentials managed by the appliance; segment the load balancer from systems containing sensitive data or credentials; and prepare a pre-configured failover load balancer in case isolation becomes operationally necessary.