CVE-2026-47871 Overview
CVE-2026-47871 is a directory traversal vulnerability in VMware Avi Load Balancer. Flaws in file path validation allow authenticated network users to perform directory traversal attacks against affected appliances. The issue is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
Broadcom, which owns the VMware portfolio, published guidance and fixed versions in Broadcom Security Advisory #37926. Successful exploitation impacts confidentiality, integrity, and availability of the load balancer.
Critical Impact
An authenticated attacker with low privileges can traverse the file system on the Avi Load Balancer over the network, reading or manipulating files outside the intended directory.
Affected Products
- VMware Avi Load Balancer 32.1.1 (fixed in 32.1.2)
- VMware Avi Load Balancer 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
- VMware Avi Load Balancer 30.1.1 through 30.2.6 (fixed in 30.2.7)
- VMware Avi Load Balancer 22.1.1 through 22.1.7 (fixed in 30.2.7)
Discovery Timeline
- 2026-07-18 - CVE-2026-47871 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-47871
Vulnerability Analysis
CVE-2026-47871 is a directory traversal flaw in the file handling logic of VMware Avi Load Balancer. The product fails to properly validate user-supplied file path input, allowing traversal sequences such as ../ to escape the intended base directory. Authenticated network users with low privileges can abuse this weakness to reach files outside of the permitted scope.
Because the Avi Load Balancer typically operates in front of critical application infrastructure, unauthorized access to configuration data, certificates, or private keys can undermine downstream services. The vulnerability impacts confidentiality, integrity, and availability without requiring user interaction.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. Input paths supplied by authenticated users are not canonicalized or restricted to an allowlisted base directory before being consumed by file system APIs. Attackers can therefore embed traversal sequences that resolve to arbitrary locations on the appliance.
Attack Vector
The attack vector is network-based. An authenticated user sends crafted requests containing traversal payloads through the exposed management or API surface of the Avi Load Balancer. No user interaction is required, and attack complexity is low. Broadcom has not published proof-of-concept exploit code, and there is no confirmed exploitation in the wild.
Because valid credentials are required, credential theft, weak account hygiene, or compromise of an operator account are prerequisites for exploitation. Consult Broadcom Security Advisory #37926 for the technical description.
Detection Methods for CVE-2026-47871
Indicators of Compromise
- Requests to the Avi Load Balancer API or management interface containing traversal sequences such as ../, ..%2f, or encoded variants targeting file path parameters.
- Unexpected access to sensitive files on the appliance, including SSL/TLS private keys, certificates, or configuration exports.
- Authenticated sessions performing file-read operations outside of normal administrative workflows.
Detection Strategies
- Inspect Avi Load Balancer audit logs for authenticated API calls containing directory traversal patterns in file or path parameters.
- Correlate unusual file access with the specific user account and source IP to identify credential misuse.
- Baseline normal administrative behavior and alert on deviations, such as file reads from non-standard paths.
Monitoring Recommendations
- Forward Avi Load Balancer syslog and audit events to a centralized logging platform for retention and analysis.
- Enable alerts on repeated failed authentication attempts followed by successful logins from the same source.
- Monitor egress traffic from the appliance for exfiltration of large or sensitive files after authenticated sessions.
How to Mitigate CVE-2026-47871
Immediate Actions Required
- Upgrade VMware Avi Load Balancer to a fixed release: 32.1.2, 31.2.2-2p3, or 30.2.7, depending on the deployed branch.
- Restrict management and API interface access to trusted administrative networks using firewall rules or ACLs.
- Rotate credentials for any operator or API accounts that could be leveraged to authenticate to the appliance.
- Review audit logs for prior directory traversal attempts against affected versions.
Patch Information
Broadcom has released fixed builds for each affected branch. Version 32.1.1 is fixed in 32.1.2. Versions 31.1.1 through 31.2.2 are fixed in 31.2.2-2p3. Versions 30.1.1 through 30.2.6 and 22.1.1 through 22.1.7 are fixed in 30.2.7. Refer to Broadcom Security Advisory #37926 for upgrade instructions.
Workarounds
- No official workaround is documented by Broadcom. Upgrading to a fixed version is the recommended remediation.
- Reduce risk by enforcing least-privilege access and multi-factor authentication for all Avi Load Balancer operator accounts.
- Segment the management plane so only authorized administrative hosts can reach the appliance.
# Example: restrict management access to a trusted subnet using iptables on an upstream jump host
iptables -A OUTPUT -d <avi-lb-mgmt-ip> -p tcp --dport 443 -s 10.10.10.0/24 -j ACCEPT
iptables -A OUTPUT -d <avi-lb-mgmt-ip> -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
