Critical Authentication Bypass Flaw Discovered in VMware Avi Load Balancer

VMware Avi Load Balancer is currently impacted by a critical authentication bypass vulnerability, tracked as CVE-2026-47865. With a CVSS score of 9.8, this flaw allows a malicious user with network access to completely circumvent authentication mechanisms and gain unauthorized access to the Avi Control plane.

What's at Risk

The vulnerability affects multiple versions of the VMware Avi Load Balancer, specifically releases 31.1.1 through 31.2.2, 30.1.1 through 30.2.6, and 22.1.1 through 22.1.7. Organizations that deploy this product in internet-facing environments or within segments accessible to unauthorized network users are at the highest risk, as the control plane serves as a central management interface for load balancing infrastructure.

How the Flaw Works

Authentication bypass vulnerabilities generally occur when an application fails to properly verify the identity of a user or the validity of a session token before granting access to sensitive functions. In a typical scenario involving this class of weakness, an attacker might leverage malformed requests or manipulate specific headers to trick the application into believing they have already successfully authenticated. Once the authentication check is bypassed, the attacker may gain the same privileges as an authorized administrator, allowing them to modify configurations, intercept traffic, or disrupt services managed by the load balancer.

How to Protect Your Systems

• Immediately upgrade to the patched versions: 31.2.2-2p3 for the 31.x branch, or 30.2.7 for both the 30.x and 22.x branches.
• Restrict network access to the Avi Control plane by ensuring it is not exposed directly to the public internet.
• Implement strict network segmentation to ensure that only authorized management workstations can communicate with the control plane interface.
• Monitor system logs for unusual authentication patterns or unauthorized access attempts targeting the management interface.
• Regularly review vendor hardening guides and security advisories to ensure that management interfaces are configured with the principle of least privilege.

Given the critical severity of this vulnerability and the potential for full control over the load balancing infrastructure, prompt action is essential. Organizations should prioritize patching these affected systems immediately to mitigate the risk of unauthorized access and potential service disruption.