Critical Auth Bypass Hits VMware Avi Load Balancer

VMware Avi Load Balancer is currently affected by a critical authentication bypass vulnerability, tracked as CVE-2026-47865. With a CVSS score of 9.8, this flaw allows a malicious actor with network access to completely circumvent the authentication mechanism and gain unauthorized entry to the Avi Control plane.

What's at Risk

The vulnerability impacts various versions of the VMware Avi Load Balancer, specifically releases in the 31.1.1 through 31.2.2 range, 30.1.1 through 30.2.6, and 22.1.1 through 22.1.7. Organizations utilizing these versions in internet-facing configurations are at the highest level of risk, as the control plane is often the central nervous system for load balancing infrastructure.

In general, any organization that relies on the Avi Load Balancer to manage traffic for sensitive applications or internal services should consider their infrastructure compromised until the necessary patches are applied. Because this vulnerability targets the authentication layer, it effectively removes the primary gatekeeper for the administrative environment.

How the Flaw Works

An authentication bypass is a severe class of vulnerability that occurs when a system fails to properly verify the identity of a user or service requesting access. In a typical scenario, an attacker might exploit logic errors in the web application's session management or request handling to bypass the login process entirely.

Once the authentication check is successfully bypassed, the attacker usually gains the same level of access as a legitimate administrator. This level of unauthorized access often allows the attacker to modify load balancing rules, intercept traffic, exfiltrate sensitive data, or pivot deeper into the internal network. Because the system believes the request is authenticated, it may bypass standard security logging and monitoring controls that would otherwise alert security teams to suspicious activity.

How to Protect Your Systems

• Upgrade to version 31.2.2-2p3 if you are on the 31.x branch.
• Upgrade to version 30.2.7 if you are on the 30.x or 22.x branches.
• Restrict access to the Avi Control plane to trusted management networks only, ensuring it is not exposed to the public internet.
• Implement strict network segmentation to limit the potential blast radius if an administrative interface is compromised.
• Monitor system logs for unusual administrative logins or unauthorized configuration changes.
• Enforce multi-factor authentication (MFA) for all administrative access points to provide a secondary layer of defense.

Given the critical severity of this flaw, the window for remediation is narrow. Attackers often prioritize vulnerabilities that allow for full control of infrastructure, making prompt patching the most effective way to secure your environment against potential exploitation of this authentication bypass.