CVE-2026-47870: VMware Avi Load Balancer Privilege Escalation

CVE-2026-47870 Overview

CVE-2026-47870 is a privilege escalation vulnerability in VMware Avi Load Balancer. An authenticated user with network access can leverage the flaw to execute remote code on the appliance. The issue is tracked under CWE-269: Improper Privilege Management and carries a CVSS v3.1 score of 7.1.

Broadcom has published a security advisory and shipped fixed builds across the affected release trains. Because Avi Load Balancer sits inline for application delivery, successful exploitation gives an attacker code execution in a position that can observe or manipulate application traffic.

Critical Impact
An authenticated attacker with network reachability to the management plane can escalate privileges and execute remote code on the load balancer, undermining the confidentiality and availability of proxied applications.

Affected Products

VMware Avi Load Balancer 32.1.1 (fixed in 32.1.2)
VMware Avi Load Balancer 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
VMware Avi Load Balancer 30.1.1 through 30.2.6, and 22.1.1 through 22.1.7 (fixed in 30.2.7)

Discovery Timeline

2026-07-18 - CVE-2026-47870 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47870

Vulnerability Analysis

CVE-2026-47870 is a privilege escalation issue that allows an authenticated user to reach code paths reserved for higher-privileged roles. Broadcom's advisory describes the outcome as remote code execution on the appliance. The vulnerability is classified under CWE-269: Improper Privilege Management, indicating that authorization checks fail to constrain what a low-privileged account can invoke.

Exploitation requires valid credentials and network access to the management interface. No user interaction is required, and the attack complexity is low. The impact is scoped to the compromised load balancer instance, but because Avi Load Balancer terminates and forwards application traffic, downstream services inherit the risk.

Root Cause

The root cause is improper privilege management in the Avi Load Balancer control plane. Authenticated actions available to lower-privileged accounts are not properly gated against operations that should require administrative context. When those operations are reached, they run with elevated authority and permit arbitrary code execution.

Attack Vector

The attack vector is network-based and requires authentication. An attacker who already holds a valid low-privileged Avi account, or who obtains one through credential theft or another vulnerability, sends crafted requests to the management API. The requests invoke privileged functionality that lacks adequate authorization enforcement, yielding code execution on the appliance.

Broadcom has not published proof-of-concept code, and there are no reports of exploitation in the wild. Refer to the Broadcom Security Advisory for vendor technical details.

Detection Methods for CVE-2026-47870

Indicators of Compromise

Unexpected shell processes or child processes spawned by Avi Load Balancer management or controller services.
Administrative configuration changes, new local accounts, or modified role bindings originating from non-administrative user sessions.
Outbound network connections from the Avi controller to unfamiliar external hosts, which may indicate post-exploitation staging.
Anomalous entries in Avi audit logs where low-privileged users invoke privileged API endpoints.

Detection Strategies

Baseline API usage per user role and alert when non-administrative accounts call administrative endpoints on the Avi controller.
Correlate authentication events with subsequent privileged action logs to identify role boundary violations.
Monitor appliance file system integrity for changes to binaries, scripts, or scheduled tasks outside of vendor updates.

Monitoring Recommendations

Forward Avi Load Balancer audit and access logs to a central SIEM for retention and correlation.
Enable alerting on failed and successful privilege changes, including role assignments and tenant modifications.
Track version and patch state of every Avi controller and service engine to confirm mitigation coverage.

How to Mitigate CVE-2026-47870

Immediate Actions Required

Upgrade Avi Load Balancer to a fixed release: 32.1.2, 31.2.2-2p3, or 30.2.7 depending on the current train.
Restrict network access to the Avi controller management interface to trusted administrative subnets only.
Audit local and remote user accounts on the controller and revoke credentials that are unused or over-privileged.
Rotate credentials and API tokens for any account that could reach the management plane.

Patch Information

Broadcom has released fixed builds for all supported branches. Systems running 32.1.1 should upgrade to 32.1.2. Systems running 31.1.1 through 31.2.2 should upgrade to 31.2.2-2p3. Systems running 30.1.1 through 30.2.6 and 22.1.1 through 22.1.7 should upgrade to 30.2.7. Full details are available in the Broadcom Security Advisory.

Workarounds

No vendor-supplied workaround is listed; apply the fixed builds as soon as change windows allow.
As a compensating control, enforce network segmentation and multi-factor authentication for all Avi administrative access.
Reduce the number of accounts with any access to the Avi controller and review role assignments for least privilege.

bash

# Verify installed Avi Load Balancer version on the controller
# Replace <controller> and <token> with your environment values
curl -sk -H "Authorization: Bearer <token>" \
     https://<controller>/api/initial-data | \
     grep -i version