EUVD-2026-45361
GHSA-7hx5-4268-25qv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
PR:L reflects the required low-privilege account; AV:N/AC:L/UI:N match a network authorization bypass; I lowered I to L because access is described as a 'limited subset,' though C:H is retained conservatively.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Lifecycle Timeline
2DescriptionCVE.org
VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization.
Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)
Articles & Coverage 1
AnalysisAI
Authorization bypass in VMware Avi Load Balancer (branches 22.1.x, 30.x, 31.x, and 32.1.1) allows a network-based actor holding low-privilege credentials to reach a limited subset of the Avi Control Plane without proper authorization. Rated CVSS 8.3 by VMware/Broadcom with CWE-863 (Incorrect Authorization), the flaw exposes control-plane functionality that should be gated behind higher authorization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the Avi Load Balancer Control Plane and a valid low-privilege authenticated principal (CVSS PR:L) - this is an authorization bypass that escalates access for an already-authenticated actor, not an unauthenticated remote compromise. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, score 8.3) indicates a network-reachable, low-complexity attack requiring low privileges and no user interaction, with high confidentiality and integrity impact but only low availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a low-privilege Avi account (for example via credential phishing, a reused password, or lateral movement onto the management network) sends authenticated requests to the Avi Control Plane and, because of the broken authorization check, reaches configuration or data-plane management functions their role should not permit. Given AV:N and AC:L, no special timing or user interaction is needed once network access and credentials are in hand; no public POC is currently identified, so an attacker would need to discover or reverse-engineer the specific unprotected endpoints. |
| Remediation | Apply the vendor-released patches for your branch: upgrade 32.1.1 to 32.1.2, upgrade the 31.1.1-31.2.2 range to 31.2.2-2p3, upgrade the 30.1.1-30.2.6 range to 30.2.7, and migrate the 22.1.1-22.1.7 range to 30.2.7 as indicated in the advisory (confirm the exact 22.1.x target build with Broadcom, as mapping a 22.1 branch to a 30.2.7 fix is unusual and should be validated before scheduling). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all VMware Avi Load Balancer deployments to identify affected versions (22.1.x, 30.x, 31.x, 32.1.1) and document their network isolation status. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Avi Load Balancer
View allAuthentication bypass in VMware Avi Load Balancer (versions 22.1.1-22.1.7, 30.1.1-30.2.6, and 31.1.1-31.2.2) lets a netw
Directory traversal in VMware Avi Load Balancer (formerly Avi Networks NSX Advanced Load Balancer) lets authenticated ne
Remote code execution in VMware Avi Load Balancer (versions 22.1.x, 30.1.x/30.2.x, 31.1.x/31.2.x, and 32.1.1) allows an
Remote code execution in VMware (Broadcom) Avi Load Balancer allows a network-adjacent, high-privileged user to reach th
Local privilege escalation in VMware (Broadcom) Avi Load Balancer allows a user who already has local access to the appl
Privilege escalation leading to remote code execution in VMware (Broadcom) Avi Load Balancer allows an authenticated use
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today