CVE-2026-47866 Overview
CVE-2026-47866 is an authorization bypass vulnerability in VMware Avi Load Balancer. A malicious actor with network access can reach a limited subset of the Avi Control Plane without proper authorization. The flaw is classified under [CWE-863] Incorrect Authorization and carries a CVSS 3.1 base score of 8.3.
Broadcom disclosed the issue in Security Advisory #37926. Affected releases span the 22.1.x, 30.1.x-30.2.x, 31.1.x-31.2.x, and 32.1.x branches. Fixed builds are available in 32.1.2, 31.2.2-2p3, and 30.2.7.
Critical Impact
An authenticated attacker on the network can bypass authorization checks in the Avi Control Plane, exposing high-confidentiality data and enabling unauthorized modification of load balancer configuration.
Affected Products
- VMware Avi Load Balancer 32.1.1 (fixed in 32.1.2)
- VMware Avi Load Balancer 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
- VMware Avi Load Balancer 30.1.1 through 30.2.6 and 22.1.1 through 22.1.7 (fixed in 30.2.7)
Discovery Timeline
- 2026-07-18 - CVE-2026-47866 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-47866
Vulnerability Analysis
VMware Avi Load Balancer is a software-defined application delivery controller that provides load balancing, web application firewall, and analytics services. The Avi Control Plane exposes management APIs used to configure virtual services, pools, and policies.
CVE-2026-47866 breaks the authorization model on a subset of Control Plane endpoints. An attacker who reaches the Control Plane over the network can invoke functionality intended for privileged roles. The vulnerability requires low-privilege access but no user interaction, and it affects confidentiality and integrity of managed traffic policies.
Root Cause
The issue is an Incorrect Authorization weakness [CWE-863]. The Control Plane accepts requests to specific resources without verifying that the caller holds the role required for the requested operation. Role or scope checks are missing or incorrectly evaluated on the affected code paths, so authenticated but under-privileged principals reach data and actions that should be gated.
Attack Vector
Exploitation occurs over the network against the Avi Control Plane management interface. An attacker with a valid but limited credential submits crafted API calls to endpoints that fail to enforce the correct authorization scope. Successful requests return sensitive control plane data or accept configuration changes. No exploit code is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Broadcom Security Advisory #37926 provides remediation details. See the Broadcom Security Advisory #37926 for technical guidance.
Detection Methods for CVE-2026-47866
Indicators of Compromise
- Control Plane API requests from low-privilege accounts targeting administrative endpoints outside their normal usage pattern.
- Successful HTTP 200 responses to management API calls that historically returned 401 or 403 for the same principal.
- Unexpected changes to virtual services, pools, SSL profiles, or WAF policies not tied to a change ticket.
- Authentication sessions from network segments that do not normally administer the Avi Control Plane.
Detection Strategies
- Enable audit logging on the Avi Control Plane and forward events to a SIEM for correlation against role assignments.
- Baseline API usage per user and role, then alert on deviations such as new endpoints accessed or elevated methods invoked.
- Compare configuration snapshots on a schedule and alert on drift that lacks an authorized change record.
Monitoring Recommendations
- Continuously monitor Avi Control Plane authentication and authorization logs for anomalous access patterns.
- Track network flows to the Control Plane management interface and restrict them to known administrative hosts.
- Alert on tenant boundary violations where one tenant's principal queries another tenant's resources.
How to Mitigate CVE-2026-47866
Immediate Actions Required
- Upgrade affected instances to 32.1.2, 31.2.2-2p3, or 30.2.7 as documented in Broadcom Security Advisory #37926.
- Restrict network reachability of the Avi Control Plane to a dedicated management network and jump hosts.
- Rotate credentials and API tokens for any accounts that could have been used against unpatched instances.
- Review recent Control Plane audit logs for unauthorized configuration changes.
Patch Information
Broadcom has released fixed builds for each supported branch. Upgrade paths per the advisory are: 32.1.1 to 32.1.2; 31.1.1 through 31.2.2 to 31.2.2-2p3; 30.1.1 through 30.2.6 to 30.2.7; and 22.1.1 through 22.1.7 to 30.2.7. Full details are available in the Broadcom Security Advisory #37926.
Workarounds
- No official workaround is published. Broadcom directs administrators to apply the fixed builds.
- Until patching completes, enforce network-level access control lists that limit Control Plane API access to trusted administrative sources.
- Reduce the number of accounts with any level of Control Plane access and audit remaining role assignments.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
