Broadcom has released new updates addressing multiple critical and high-severity vulnerabilities in the VMware Avi Load Balancer. This software-defined platform is crucial for load balancing and securing applications across hybrid and multi-cloud environments.
Discovery of Critical Vulnerabilities
Recent findings by two external researchers have revealed seven significant vulnerabilities in the VMware product. Filip Waeytens, associated with NATO’s technology and cyber hub, identified a critical flaw (CVE-2026-47865) that allows attackers with network access to bypass authentication and compromise the Avi control plane.
High-Severity Flaws Uncovered
Waeytens also reported three high-severity vulnerabilities, which could lead to authentication bypass, arbitrary code execution, and privilege escalation to root. These issues, identified as CVE-2026-47866, CVE-2026-47867, and CVE-2026-47868, require network or local access for exploitation.
Additionally, Lang Khuong Duy from Viettel IDC found two high-severity bugs that can be used for directory traversal attacks (CVE-2026-47871) and privilege escalation (CVE-2026-47870). Both researchers have been acknowledged for their contributions.
Importance of Immediate Updates
Another vulnerability, CVE-2026-47869, reported jointly by Lang and Waeytens, involves remote code execution, exploitable by authenticated attackers with network access. While there are no known active exploits for these vulnerabilities, organizations are urged to apply the latest patches promptly to prevent potential attacks.
Historically, VMware product vulnerabilities have been targeted by threat actors, making timely updates critical for maintaining security. Staying ahead of potential threats by implementing these patches is essential for organizations utilizing VMware Avi Load Balancer.
For more information on related security updates, see our articles on recent VMware Fusion and VMware Aria Operations vulnerabilities.
