CVE-2026-47868Broadcom Vmware Avi Load Balancer Improper Privilege Management
NVDCVSS scored by security@vmware.com
Vulnerability Summary
VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate their privileges to run code as root.
Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
30.1.1 through 30.2.6 (fixed in 30.2.7)
22.1.1 through 22.1.7 (fixed in 30.2.7)
Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
30.1.1 through 30.2.6 (fixed in 30.2.7)
22.1.1 through 22.1.7 (fixed in 30.2.7)
CVSS v3.1 Base Metrics — Score 7.8 (HIGH)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HAttack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected & Patched Versions
- Broadcom Vmware Avi Load Balancer >= 22.1.1 and <= 22.1.7
- Broadcom Vmware Avi Load Balancer >= 30.1.1 and < 30.2.7
- Broadcom Vmware Avi Load Balancer >= 31.1.1 and < 31.2.2
- Broadcom Vmware Avi Load Balancer
- Broadcom Vmware Avi Load Balancer 30.2.7
- Broadcom Vmware Avi Load Balancer 31.2.2
What to do
Plan remediation soon. No exploitation is confirmed yet, but the severity is high.
- Check whether you run Broadcom Vmware Avi Load Balancer and which version.
- Update to a patched version listed above, then confirm the new version.
Timeline
- Jul 18, 2026Published
- Oct 24, 2026Record last modified
Score, severity and exploitation changes are tracked from the day Watchtower started logging them.
Get notified about new Broadcom Vmware Avi Load Balancer CVEsYou are reading CVE-2026-47868. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alertsRelated Coverage
External References
Data last checked: Nov 15, 2026 23:12 UTC