Vulnerability details
CVE-2026-47869
VMware Avi Load Balancer
VMware Avi Load Balancer Remote Code Execution Vulnerability
CVSS 3.1
8.7High
Official description
VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute code. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.7High | 3.1 | CVEProject cvelistV5 (CNA) (vmware) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| VMware | Avi Load Balancer | 32.1.1 | CVEProject cvelistV5 (CNA) |
| VMware | Avi Load Balancer | 22.1.1 ≤ v ≤ 22.1.7 | CVEProject cvelistV5 (CNA) |
| VMware | Avi Load Balancer | 30.1.1 ≤ v ≤ 30.2.6 | CVEProject cvelistV5 (CNA) |
| VMware | Avi Load Balancer | 31.1.1 ≤ v ≤ 31.2.2 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-07-18
- Last updated
- 2026-07-23
- State
- Published
- Assigner (CNA)
- vmware
Exploit prediction (EPSS)
0.73%
Probability of exploitation in 30 days
54.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-94Improper Control of Generation of Code ('Code Injection')