VMware Avi Load Balancer Authentication Bypass Vulnerability (CVE-2026-47865)

VMware has disclosed a critical authentication bypass vulnerability, tracked as CVE-2026-47865, affecting multiple versions of the Avi Load Balancer. With a CVSS score of 9.8, the flaw allows a malicious user with network access to completely circumvent the authentication mechanism and gain unauthorized access to the Avi Control plane.

This vulnerability is particularly significant because the control plane serves as the central management point for the entire load balancing infrastructure. By bypassing authentication, an attacker could potentially gain full control over traffic distribution, security policies, and administrative configurations, posing a severe risk to the integrity and availability of the underlying network services.

What's at Risk

The affected software versions include 31.1.1 through 31.2.2, 30.1.1 through 30.2.6, and 22.1.1 through 22.1.7. Organizations running these specific versions of the VMware Avi Load Balancer are at risk, particularly if the management interface is exposed to broader network segments or the public internet.

Generally, systems that serve as central management hubs are high-value targets. When these appliances are deployed in internet-facing configurations, they become susceptible to automated scanning and exploitation attempts from external threat actors seeking to gain a foothold within a corporate or data center network.

How the Flaw Works

An authentication bypass vulnerability typically occurs when a software application fails to properly verify the identity of a user or system before granting access to protected resources. In many cases, this happens due to flaws in the session management logic, improper validation of incoming request headers, or errors in the API endpoint authorization checks.

When this type of weakness is present, an attacker does not need valid credentials to interact with the system. Instead, they can craft specific requests that trick the application into believing the session has already been authenticated. Once the bypass is successful, the attacker can interact with administrative functions as if they were a legitimate, privileged user, allowing them to modify configurations, exfiltrate data, or disrupt service operations.

How to Protect Your Systems

• Upgrade to version 31.2.2-2p3 or 30.2.7 immediately to apply the vendor-supplied security fixes.
• Restrict access to the Avi Control plane management interface to trusted, internal management networks only.
• Implement strict network segmentation to ensure that the load balancer management plane is not reachable from untrusted zones.
• Enable comprehensive logging and monitoring to detect unauthorized or anomalous access attempts to the control plane.
• Follow official VMware hardening guides to ensure the appliance is configured with the principle of least privilege.

Given the critical severity of this flaw and the high level of access granted to an attacker, organizations must prioritize patching immediately. Failure to address this vulnerability leaves the core management layer of the network infrastructure exposed to unauthorized control, which could lead to widespread service disruption or unauthorized data access.