Critical Authentication Bypass Found in VMware Avi Load Balancer

VMware has disclosed a critical authentication bypass vulnerability, tracked as CVE-2026-47865, affecting multiple versions of the Avi Load Balancer. With a CVSS score of 9.8, this flaw allows an unauthenticated attacker with network access to bypass the authentication mechanism and gain access to the Avi Control plane.

What's at Risk

The vulnerability impacts a wide range of deployments, specifically versions 31.1.1 through 31.2.2, 30.1.1 through 30.2.6, and 22.1.1 through 22.1.7. Organizations utilizing these versions of the VMware Avi Load Balancer are at risk, particularly those with management interfaces exposed to the internet or accessible from untrusted network segments.

In general, load balancers serve as central points of traffic management and security enforcement for enterprise applications. When a control plane is compromised, the entire traffic steering architecture of an organization can be placed at risk, potentially leading to unauthorized data interception or service disruption.

How the Flaw Works

Authentication bypass vulnerabilities represent a critical security failure in the verification process that determines the identity of a user or system. When this mechanism is bypassed, an attacker effectively circumvents the security gates that are designed to restrict administrative access to sensitive infrastructure.

In a typical scenario involving an authentication bypass, the software fails to properly validate the credentials or session tokens provided by the requester. This allows an attacker to interact with privileged functions as if they were a legitimate administrator. By gaining unauthorized access to the control plane, an attacker can modify load balancing policies, redirect traffic, or extract configuration data, which often contains sensitive information about the backend environment.

How to Protect Your Systems

• Immediately update to the patched versions: 31.2.2-2p3 for the 31.x branch or 30.2.7 for the 30.x and 22.x branches.
• Restrict network access to the Avi Control plane by ensuring it is not exposed to the public internet.
• Implement network segmentation to limit access to management interfaces to authorized personnel and trusted subnets only.
• Enforce multi-factor authentication (MFA) across all administrative interfaces to add an extra layer of protection against unauthorized access.
• Regularly monitor system logs for unusual authentication patterns or unauthorized access attempts to the control plane.

Given the critical severity of CVE-2026-47865, organizations should prioritize patching as an urgent security measure. Because this vulnerability allows for complete control over the Avi Control plane, delay in applying these fixes leaves infrastructure highly susceptible to exploitation by malicious actors who may seek to leverage this bypass for deeper network intrusion.