Broadcom Patches Seven Severe VMware Avi Load Balancer Vulnerabilities
Summary
Broadcom released updates for seven critical- and high-severity VMware Avi Load Balancer vulnerabilities, including authentication bypass, code execution, privilege escalation and directory traversal flaws. Its advisory does not report in-the-wild exploitation.
Key points
- CVE-2026-47865 is a critical authentication bypass that could let an attacker with network access breach the Avi control plane.
- CVE-2026-47866, CVE-2026-47867 and CVE-2026-47868 can enable authentication bypass, arbitrary code execution or root privilege escalation; network or local access is required.
- CVE-2026-47871 is a directory traversal flaw, while CVE-2026-47870 enables privilege escalation.
- CVE-2026-47869 is a high-severity remote code execution flaw exploitable by an authenticated attacker with network access.
- Broadcom credited Filip Waeytens and Lang Khuong Duy with discovering and responsibly reporting the flaws.
- Broadcom’s advisory does not mention in-the-wild exploitation; organizations are advised to install the latest updates.
Article Details
- Vulnerability Types
- Authentication bypass
- Arbitrary code execution
- Privilege escalation
- Directory traversal
- Remote code execution
- Severity
- One critical and six high-severity vulnerabilities
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-47865Filip Waeytens of NATO’s technology and cyber hub has been credited with discovering CVE-2026-47865, a critical authentication bypass issue that allows an attacker with network access to breach the Avi control plane.CVE-2026-47866Network or local access is required for the exploitation of these flaws, which are tracked as CVE-2026-47866, CVE-2026-47867 and CVE-2026-47868.CVE-2026-47867Network or local access is required for the exploitation of these flaws, which are tracked as CVE-2026-47866, CVE-2026-47867 and CVE-2026-47868.CVE-2026-47868Network or local access is required for the exploitation of these flaws, which are tracked as CVE-2026-47866, CVE-2026-47867 and CVE-2026-47868.CVE-2026-47869Both Lang and Waeytens have been credited by Broadcom for responsibly reporting CVE-2026-47869, a high-severity remote code execution vulnerability that can be exploited by an authenticated attacker with network access.CVE-2026-47870Lang Khuong Duy of Viettel IDC discovered two high-severity Avi Load Balancer bugs that can be exploited for directory traversal attacks (CVE-2026-47871) and privilege escalation (CVE-2026-47870).CVE-2026-47871Lang Khuong Duy of Viettel IDC discovered two high-severity Avi Load Balancer bugs that can be exploited for directory traversal attacks (CVE-2026-47871) and privilege escalation (CVE-2026-47870).
People
Filip WaeytensCredited with discovering CVE-2026-47865, CVE-2026-47866, CVE-2026-47867, and CVE-2026-47868; also credited by Broadcom with responsibly reporting CVE-2026-47869.Lang Khuong DuyDiscovered CVE-2026-47870 and CVE-2026-47871; also credited by Broadcom with responsibly reporting CVE-2026-47869.