CVE-2026-47869: VMware Avi Load Balancer RCE Vulnerability

CVE-2026-47869 Overview

CVE-2026-47869 is a remote code execution vulnerability in VMware Avi Load Balancer. An authenticated user with network access can inject and execute arbitrary code on the appliance. The flaw is classified as code injection [CWE-94] and requires high privileges but no user interaction.

Broadcom published Security Advisory #37926 describing affected versions across the 22.1.x, 30.1.x, 30.2.x, 31.1.x, 31.2.x, and 32.1.x branches. Successful exploitation gives an attacker control over a network component that terminates and routes application traffic, expanding blast radius into downstream services.

Critical Impact
An authenticated attacker with network access to VMware Avi Load Balancer can inject and execute code, compromising confidentiality and integrity of the appliance and routed traffic.

Affected Products

VMware Avi Load Balancer 32.1.1 (fixed in 32.1.2)
VMware Avi Load Balancer 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
VMware Avi Load Balancer 30.1.1 through 30.2.6 (fixed in 30.2.7), and 22.1.1 through 22.1.7 (fixed in 30.2.7)

Discovery Timeline

2026-07-18 - CVE-2026-47869 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47869

Vulnerability Analysis

CVE-2026-47869 is a code injection weakness [CWE-94] in the VMware Avi Load Balancer control plane. An authenticated user with network reachability to the management interface can supply input that the appliance interprets and executes as code. Because the scope changes during exploitation, the vulnerable component can affect resources beyond its own security authority, including traffic flows managed by the load balancer.

The flaw impacts confidentiality and integrity of processed data and configuration but does not directly affect availability. The EPSS probability is 0.441% as of 2026-07-24, indicating limited observed exploitation activity at disclosure.

Root Cause

The root cause is improper control of code generation. The Avi Load Balancer accepts input from authenticated management channels and passes it into an execution context without sufficient neutralization. Broadcom has not published detailed root-cause internals in the public advisory. See the Broadcom Security Advisory #37926 for vendor-supplied technical details.

Attack Vector

Exploitation requires network access to the Avi Load Balancer management surface and valid high-privilege credentials. The attacker submits crafted input through an authenticated interface, which the appliance evaluates as code and runs in its own execution context. No user interaction is required. Because the load balancer sits inline with application traffic, code execution on the appliance can be used to intercept, modify, or redirect requests to backend services.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-47869

Indicators of Compromise

Unexpected administrative sessions or API calls to the Avi Load Balancer control plane from unusual source addresses or service accounts.
New or modified scripts, configuration objects, or DataScript entries that were not part of a change-managed deployment.
Outbound connections from the load balancer appliance to untrusted hosts, which may indicate post-exploitation command and control.

Detection Strategies

Audit Avi Controller logs for authenticated API and UI requests that submit code-like payloads, template strings, or unexpected object definitions.
Baseline legitimate administrative activity, then alert on deviations in request paths, parameter sizes, and originating identities.
Correlate appliance process execution and outbound network telemetry to identify code execution outside normal service processes.

Monitoring Recommendations

Forward Avi Controller audit logs and system logs to a centralized SIEM for retention and correlation with identity and network telemetry.
Monitor privileged account usage on the load balancer and alert on logins outside approved administrative windows or source ranges.
Track file integrity on the appliance for configuration and script objects that should only change via approved automation.

How to Mitigate CVE-2026-47869

Immediate Actions Required

Upgrade VMware Avi Load Balancer to a fixed release: 32.1.2, 31.2.2-2p3, or 30.2.7 as applicable to the deployed branch.
Restrict network access to the Avi Controller management interfaces to a hardened administrative network and jump hosts only.
Rotate credentials for administrative and API accounts on the appliance and review recent audit logs for unauthorized use.

Patch Information

Broadcom has released fixed versions for each affected branch. Deployments on 22.1.1 through 22.1.7 and 30.1.1 through 30.2.6 should move to 30.2.7. Deployments on 31.1.1 through 31.2.2 should move to 31.2.2-2p3. Deployments on 32.1.1 should move to 32.1.2. Refer to the Broadcom Security Advisory #37926 for upgrade guidance.

Workarounds

Limit management-plane exposure with network access control lists that only permit trusted administrative subnets.
Enforce multi-factor authentication and least-privilege role assignments for all Avi Controller accounts.
Review and remove unused high-privilege accounts and API tokens on the appliance until patching is complete.

bash

# Configuration example: restrict Avi Controller management access at the network layer
# Replace 10.0.0.0/24 with your administrative subnet
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 22  -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 22  -j DROP