CVE-2026-47869
published 2026-07-18CVE-2026-47869: VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute…
PriorityP263high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.74%
54.1th percentile
VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute code.
Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
30.1.1 through 30.2.6 (fixed in 30.2.7)
22.1.1 through 22.1.7 (fixed in 30.2.7)
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| broadcom | vmware_avi_load_balancer | — | — |
| broadcom | vmware_avi_load_balancer | — | — |
| broadcom | vmware_avi_load_balancer | — | — |
| broadcom | vmware_avi_load_balancer | — | — |
| broadcom | vmware_avi_load_balancer | 22.1.1 – 22.1.7 | — |
| broadcom | vmware_avi_load_balancer | >= 30.1.1 < 30.2.7 | 30.2.7 |
| broadcom | vmware_avi_load_balancer | >= 31.1.1 < 31.2.2 | 31.2.2 |
| vmware | avi_load_balancer | — | — |
| vmware | avi_load_balancer | 22.1.1 – 22.1.7 | — |
| vmware | avi_load_balancer | 30.1.1 – 30.2.6 | — |
| vmware | avi_load_balancer | 31.1.1 – 31.2.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
VMware Avi Load Balancer up to 22.1.7/30.2.6/31.2.2/32.1.1 injection (EUVD-2026-45364)
vuldb·2026-07-18·CVSS 8.7
CVE-2026-47869 [HIGH] VMware Avi Load Balancer up to 22.1.7/30.2.6/31.2.2/32.1.1 injection (EUVD-2026-45364)
A vulnerability classified as very critical was found in VMware Avi Load Balancer up to 22.1.7/30.2.6/31.2.2/32.1.1. This affects an unknown part. Such manipulation leads to injection.
This vulnerability is referenced as CVE-2026-47869. It is possible to launch the attack remotely. No exploit is available.
GHSA
VMware Avi Load Balancer contains a remote code execution vulnerability.
ghsa_unreviewed·2026-07-18
CVE-2026-47869 [HIGH] CWE-94 VMware Avi Load Balancer contains a remote code execution vulnerability.
VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute code.
Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
30.1.1 through 30.2.6 (fixed in 30.2.7)
22.1.1 through 22.1.7 (fixed in 30.2.7)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-18
Published