7 Severe Vulnerabilities Patched in VMware Avi Load Balancer

# Broadcom Patches 7 Critical Vulnerabilities in VMware Avi Load Balancer; Immediate Updates Needed

VMware Avi Load Balancer, a widely deployed application delivery platform trusted by enterprises managing hybrid and multi-cloud infrastructure, is affected by seven potentially critical vulnerabilities that could allow attackers to bypass authentication, execute arbitrary code, and gain root-level access to critical systems. Broadcom announced the patches on Tuesday, following responsible disclosure by external researchers at NATO and Viettel IDC. While no active exploitation has been reported, the severity of these flaws and their network-accessible nature make immediate patching essential for organizations running Avi in production environments.

## The Threat

The seven vulnerabilities span a range of attack vectors, from unauthenticated authentication bypass to authenticated remote code execution. Collectively, they represent a comprehensive security failure that could allow an attacker to fully compromise the Avi control plane and any load-balanced applications it manages.

Critical Severity Issues:

High-Severity Issues:

## Background and Context

VMware Avi Load Balancer is a software-defined application delivery platform that abstracts load balancing, security services, and analytics into a unified control plane. It's a foundational component in many hybrid cloud deployments, managing traffic distribution across on-premises data centers, public cloud instances, and edge locations. For many enterprises, Avi serves as a critical control point for application availability and security.

Broadcom acquired VMware in late 2023, inheriting responsibility for maintaining and patching the extensive VMware product portfolio. This patch cycle adds to a growing list of significant VMware vulnerabilities addressed by Broadcom over the past 18 months, including critical flaws in VMware Aria Operations, VMware Fusion, and earlier Avi versions.

The vulnerabilities were discovered by two independent researchers:

Both researchers responsibly disclosed their findings to Broadcom, allowing the company time to develop and test patches before public disclosure.

## Technical Details

CVE-2026-47865 – The Critical Bypass

This is the most alarming flaw in the advisory. The authentication bypass requires only network access—meaning any attacker on the same network segment as the Avi control plane, or with routable network access, can establish a session without valid credentials. This is a unauthenticated compromise of the control plane, which typically manages:

An attacker exploiting this could redirect traffic, inject malicious content, or shut down services entirely.

Privilege Escalation Chain (CVE-2026-47868, CVE-2026-47870)

These vulnerabilities create a privilege escalation path to root. If an attacker gains initial access—either through CVE-2026-47865 (no credentials needed) or through a compromised application user account—they can escalate to root privileges. Root access on an Avi node would allow:

Remote Code Execution Variants

CVE-2026-47867 and CVE-2026-47869 allow arbitrary code execution, with the latter requiring prior authentication. An attacker could use CVE-2026-47865 to authenticate without credentials, then trigger CVE-2026-47869 to execute arbitrary commands within the Avi process context.

Directory Traversal (CVE-2026-47871)

Path traversal vulnerabilities allow attackers to access files outside the intended application directories, potentially exposing configuration files containing API keys, database credentials, or backup certificates.

## Implications for Organizations

Immediate Risk Categories:

| Organization Type | Risk Level | Primary Concern |

|------------------|-----------|-----------------|

| Cloud providers using Avi | Critical | Loss of tenant isolation; traffic interception |

| Enterprises with Avi in DMZ | Critical | Direct network exposure; authentication bypass |

| Hybrid cloud deployments | High | Control plane compromise; cascading failure |

| Organizations with internal Avi only | Medium | Requires internal network access, but no authentication required |

Attack Scenarios:

1. Unauthenticated Compromise: An attacker with network visibility gains direct control of the Avi control plane via CVE-2026-47865, allowing traffic manipulation or service disruption.

2. Lateral Movement: An attacker compromises an application behind Avi, then exploits CVE-2026-47869 with their compromised application credentials to escalate to Avi root access, enabling infrastructure-wide compromise.

3. Certificate Theft: An attacker uses directory traversal (CVE-2026-47871) to extract SSL/TLS certificates and private keys, enabling man-in-the-middle attacks on encrypted traffic.

While Broadcom reports no in-the-wild exploitation, VMware product vulnerabilities have historically been prioritized by threat actors. The ease of exploitation (especially CVE-2026-47865 requiring only network access) suggests these flaws could be weaponized quickly.

## Recommendations for Organizations

Immediate Actions (24-48 hours):

Patching Strategy (48-72 hours):

Compensating Controls (pending patches):

## HackWire Analysis

This patch advisory represents a critical moment for enterprise infrastructure security. VMware Avi Load Balancer sits at the boundary between trusted internal infrastructure and untrusted application code—precisely the kind of control-plane position where zero-trust architecture should apply. Yet CVE-2026-47865's unauthenticated authentication bypass suggests that security assumptions about the control plane may not have been rigorously tested.

What's particularly concerning is the *pattern*. Broadcom has now disclosed multiple critical flaws in major VMware products within 18 months: Aria Operations RCE, Fusion vulnerabilities, and now Avi's authentication bypass. This suggests either that VMware's code quality testing has degraded over time, or that the acquisition integration by Broadcom created gaps in security review processes. For organizations that standardized on VMware across their stack (Avi for load balancing, Aria for observability, vSphere for compute), the cumulative risk has become material.

The timing also matters: cloud-native deployments increasingly rely on Avi for east-west traffic control and API gateway functions. If an attacker can compromise Avi's control plane, they don't just intercept traffic—they can modify security policies, drain traffic from legitimate backends, or inject themselves into the request/response chain. For SaaS providers and API-first organizations, this is a supply-chain risk if your upstream provider runs Avi and hasn't patched.

Organizations should treat this not as a routine patch cycle but as a critical incident response: prioritize patching based on exposure (control planes on shared networks get patched first), conduct post-patch verification of configurations, and audit any changes made to Avi policies in recent months.

— HackWire Editorial

## Related Coverage