Avi Load Balancer
Monthly
Directory traversal in VMware Avi Load Balancer (formerly Avi Networks NSX Advanced Load Balancer) lets authenticated network users bypass file path validation to reach files outside intended directories. Rated CVSS 8.8, the flaw is exploitable remotely by any authenticated user (PR:L) and the vendor scores full high confidentiality, integrity, and availability impact, implying potential arbitrary file read and/or write on the appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in VMware Avi Load Balancer exposes authenticated, network-accessible users to remote code execution across a wide version range spanning 22.1.x through 32.1.x. The CVSS 8.8 rating reflects low-complexity, low-privilege network exploitation yielding full confidentiality, integrity, and availability impact on affected systems. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS at 0.39% (31st percentile) confirms limited active exploitation pressure at time of analysis.
Remote code execution in VMware Avi Load Balancer exposes organizations running versions from 22.1.1 through 32.1.1 to arbitrary code injection by low-privileged authenticated users with network access. The flaw is classified as CWE-94 code injection, meaning attacker-supplied input reaches an execution context without adequate sanitization. Broadcom has released patches across all affected branches; no public exploit code has been identified at time of analysis, and the EPSS score of 0.68% (48th percentile) reflects modest current exploitation probability despite the high CVSS 8.8 rating.
Local privilege escalation in VMware (Broadcom) Avi Load Balancer allows a user who already has local access to the appliance to elevate to root and run arbitrary code. It affects the 22.1.x, 30.x, 31.x and 32.1.x release lines, is CVSS 7.8, and was reported by the vendor. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in VMware Avi Load Balancer exposes the Avi Control Plane to arbitrary code execution by any low-privileged, network-connected user, stemming from a code injection flaw (CWE-94) in the controller. Multiple major version branches from 22.1.1 through 32.1.1 are confirmed affected, with vendor-released patches available across all branches. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 rating and full high-impact triad (C:H/I:H/A:H) make this a high-priority patch target for any deployment where the control plane is network-reachable.
Authorization bypass in VMware Avi Load Balancer (branches 22.1.x, 30.x, 31.x, and 32.1.1) allows a network-based actor holding low-privilege credentials to reach a limited subset of the Avi Control Plane without proper authorization. Rated CVSS 8.3 by VMware/Broadcom with CWE-863 (Incorrect Authorization), the flaw exposes control-plane functionality that should be gated behind higher authorization. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical rather than observed.
Authentication bypass in VMware Avi Load Balancer (versions 22.1.1-22.1.7, 30.1.1-30.2.6, and 31.1.1-31.2.2) lets a network-adjacent attacker circumvent the login mechanism and reach the Avi Controller control plane. Reported by VMware/Broadcom, it carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting full unauthenticated compromise of confidentiality, integrity and availability. No public exploit is identified at time of analysis and it is not on the CISA KEV list, but the flaw class (CWE-287) and network-reachable admin plane make it a high-priority patch.
Directory traversal in VMware Avi Load Balancer (formerly Avi Networks NSX Advanced Load Balancer) lets authenticated network users bypass file path validation to reach files outside intended directories. Rated CVSS 8.8, the flaw is exploitable remotely by any authenticated user (PR:L) and the vendor scores full high confidentiality, integrity, and availability impact, implying potential arbitrary file read and/or write on the appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in VMware Avi Load Balancer exposes authenticated, network-accessible users to remote code execution across a wide version range spanning 22.1.x through 32.1.x. The CVSS 8.8 rating reflects low-complexity, low-privilege network exploitation yielding full confidentiality, integrity, and availability impact on affected systems. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS at 0.39% (31st percentile) confirms limited active exploitation pressure at time of analysis.
Remote code execution in VMware Avi Load Balancer exposes organizations running versions from 22.1.1 through 32.1.1 to arbitrary code injection by low-privileged authenticated users with network access. The flaw is classified as CWE-94 code injection, meaning attacker-supplied input reaches an execution context without adequate sanitization. Broadcom has released patches across all affected branches; no public exploit code has been identified at time of analysis, and the EPSS score of 0.68% (48th percentile) reflects modest current exploitation probability despite the high CVSS 8.8 rating.
Local privilege escalation in VMware (Broadcom) Avi Load Balancer allows a user who already has local access to the appliance to elevate to root and run arbitrary code. It affects the 22.1.x, 30.x, 31.x and 32.1.x release lines, is CVSS 7.8, and was reported by the vendor. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in VMware Avi Load Balancer exposes the Avi Control Plane to arbitrary code execution by any low-privileged, network-connected user, stemming from a code injection flaw (CWE-94) in the controller. Multiple major version branches from 22.1.1 through 32.1.1 are confirmed affected, with vendor-released patches available across all branches. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 rating and full high-impact triad (C:H/I:H/A:H) make this a high-priority patch target for any deployment where the control plane is network-reachable.
Authorization bypass in VMware Avi Load Balancer (branches 22.1.x, 30.x, 31.x, and 32.1.1) allows a network-based actor holding low-privilege credentials to reach a limited subset of the Avi Control Plane without proper authorization. Rated CVSS 8.3 by VMware/Broadcom with CWE-863 (Incorrect Authorization), the flaw exposes control-plane functionality that should be gated behind higher authorization. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical rather than observed.
Authentication bypass in VMware Avi Load Balancer (versions 22.1.1-22.1.7, 30.1.1-30.2.6, and 31.1.1-31.2.2) lets a network-adjacent attacker circumvent the login mechanism and reach the Avi Controller control plane. Reported by VMware/Broadcom, it carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting full unauthenticated compromise of confidentiality, integrity and availability. No public exploit is identified at time of analysis and it is not on the CISA KEV list, but the flaw class (CWE-287) and network-reachable admin plane make it a high-priority patch.