CVE-2026-47867: VMware Avi Load Balancer RCE Vulnerability

CVE-2026-47867 Overview

CVE-2026-47867 is a remote code execution vulnerability in VMware Avi Load Balancer. An authenticated attacker with network access to the Avi Control plane can execute arbitrary code on the appliance. The flaw is classified under CWE-94, Improper Control of Generation of Code (Code Injection). Broadcom has released fixed builds across multiple supported branches.

Critical Impact
Successful exploitation grants remote code execution on the Avi Control plane, exposing load balancer configuration, TLS keys, and downstream application traffic to compromise.

Affected Products

VMware Avi Load Balancer 32.1.1 (fixed in 32.1.2)
VMware Avi Load Balancer 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
VMware Avi Load Balancer 30.1.1 through 30.2.6, and 22.1.1 through 22.1.7 (fixed in 30.2.7)

Discovery Timeline

2026-07-18 - CVE-2026-47867 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47867

Vulnerability Analysis

CVE-2026-47867 is a code injection weakness [CWE-94] in the Avi Load Balancer Control plane. The Control plane is the management component responsible for configuration, orchestration, and policy distribution to Avi Service Engines. A user with valid credentials and network reachability to the management interface can supply input that the application interprets as executable code.

The attack proceeds over the network without user interaction. Broadcom's advisory categorizes the issue as high-impact for confidentiality and integrity, with a scope change indicating that code execution crosses the trust boundary of the Control plane process. Attackers gaining execution can pivot to managed Service Engines, tamper with virtual service definitions, or exfiltrate TLS material.

Root Cause

The vulnerability stems from improper neutralization of directives within input processed by the Control plane. Under [CWE-94], the application constructs code or command structures using attacker-controllable data without sufficient validation, allowing the input to alter the intended execution flow.

Attack Vector

Exploitation requires network access to the Avi Control plane and high-privilege authenticated access. The attack complexity is low and no user interaction is required. Because the vulnerability is authenticated, hardening around administrative accounts and management-plane exposure directly reduces exploitability.

No verified proof-of-concept code is publicly available at this time. Refer to the Broadcom Security Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-47867

Indicators of Compromise

Unexpected child processes spawned by Avi Control plane services on the controller node.
New or modified administrative accounts, API tokens, or SSH keys on the Avi controller.
Outbound connections from the Control plane to unknown external hosts following authenticated API activity.

Detection Strategies

Enable and centralize audit logging for all Avi Control plane API calls, focusing on configuration endpoints accessed by high-privilege accounts.
Alert on shell activity, package installation, or scripting interpreter execution originating from Avi controller service accounts.
Correlate authentication events with subsequent configuration changes to identify credential misuse.

Monitoring Recommendations

Monitor the Avi controller management interface for access from IP ranges outside approved administrative networks.
Track process lineage on the controller to detect deviations from baseline behavior of the Control plane daemons.
Review Broadcom advisory bulletins and integrate vendor indicators into SIEM detection rules as they are published.

How to Mitigate CVE-2026-47867

Immediate Actions Required

Upgrade Avi Load Balancer to a fixed release: 32.1.2, 31.2.2-2p3, or 30.2.7 depending on your branch.
Restrict network access to the Avi Control plane management interface to a dedicated administrative network or bastion.
Rotate administrative credentials, API tokens, and any TLS material managed by the controller after patching.

Patch Information

Broadcom has published fixed builds for all supported branches. Versions 22.1.1 through 22.1.7 and 30.1.1 through 30.2.6 are remediated in 30.2.7. The 31.x branch is fixed in 31.2.2-2p3, and 32.1.1 is fixed in 32.1.2. Refer to the Broadcom Security Advisory for full upgrade instructions.

Workarounds

Limit exposure of the Avi Control plane to trusted management networks using firewall rules or security groups.
Enforce multi-factor authentication and role-based access control for all administrative accounts on the controller.
Audit and remove unused high-privilege accounts to reduce the population of identities capable of triggering the flaw.

bash

# Example: restrict Avi controller management access at the network layer
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP