VMware Avi Load Balancer EUVD-2026-45364

Exploitation requires the attacker to possess a valid account on the VMware Avi Load Balancer platform with at least low-privileged access (PR:L per CVSS vector) and network-level reachability to the management or API interface (AV:N). No user interaction is required (UI:N), and no elevated privilege or special role beyond basic authentication is specified in available data. The specific vulnerable endpoint, parameter, or feature enabling code injection is not disclosed in public references - the Broadcom advisory should be consulted for that detail. Exploitation is concretely limited by the authentication requirement: unauthenticated external attackers cannot exploit this vulnerability without first obtaining valid credentials through a separate attack. Additional limiting factors include that Avi Load Balancer management interfaces are typically not internet-exposed in standard enterprise deployments, reducing the realistic attacker pool to insiders or post-initial-access actors.

The CVSS 3.1 score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a high-severity, network-exploitable flaw with full confidentiality, integrity, and availability impact, requiring only low-privileged authentication and no user interaction. S:U (scope unchanged) means the blast radius is nominally contained to the Avi Load Balancer process itself, though RCE on a load balancer carries significant downstream risk given its network position. Counterbalancing signals reduce urgency: EPSS at 0.68% (48th percentile) is below average for a vulnerability of this CVSS score, no KEV listing confirms active exploitation, and no POC is referenced in available data. The authentication prerequisite (PR:L) is a genuine limiting factor - unauthenticated external attackers cannot exploit this without first obtaining credentials via a separate compromise. Real-world risk is highest for organizations with broad internal access to the Avi management plane or where credentials may be shared or weakly protected. This is a clear patch priority but not an emergency requiring immediate compensating controls unless management interfaces are internet-exposed.

An attacker holding a low-privileged account on the Avi Load Balancer platform - obtained through credential theft, phishing, or a separate compromise - crafts a malicious payload targeting an unsanitized code-evaluation input, such as a policy expression, custom script field, or configuration parameter, and submits it via the management API or UI over the network. The platform evaluates the injected code in a server-side execution context, granting the attacker arbitrary command execution on the load balancer node. No public POC has been identified at time of analysis, but the network/low-auth vector and simple code injection root cause suggest moderate exploit development effort for a skilled attacker with platform access.