Security Digest: July 18, 2026 - 6 Critical Vulnerabilities

Today’s alert is dominated by six high-severity VMware Avi Load Balancer vulnerabilities that can lead to remote code execution, authorization bypass, directory traversal, and privilege escalation. If you run Avi Load Balancer, treat this as an urgent patching event: prioritize exposed systems, verify your exact build, and move to the fixed releases immediately.

· 7 min read

Executive Summary

Today’s alert is dominated by six high-severity VMware Avi Load Balancer vulnerabilities that can lead to remote code execution, authorization bypass, directory traversal, and privilege escalation. If you run Avi Load Balancer, treat this as an urgent patching event: prioritize exposed systems, verify your exact build, and move to the fixed releases immediately.

Because several of these issues require authenticated or network access, the risk is highest anywhere Avi is reachable by admins, operators, contractors, or internal users. Do not wait for exploitation reports; patch now and restrict access until upgrades are complete.

Critical Vulnerabilities

CVE-2026-47871: VMware Avi directory traversal

  • Impact: Malicious authenticated network users may traverse directories and access or manipulate files outside intended paths.
  • Affected Systems: VMware Avi Load Balancer 32.1.1; 31.1.1 through 31.2.2; 30.1.1 through 30.2.6; 22.1.1 through 22.1.7.
  • Immediate Action: Upgrade to a fixed release immediately and restrict authenticated access to Avi management interfaces until patched.
  • Mitigation: Apply 32.1.2, 31.2.2-2p3, or 30.2.7 as appropriate for your branch.

CVE-2026-47869: VMware Avi remote code execution

  • Impact: An authenticated network user may inject and execute code on the appliance.
  • Affected Systems: Same affected Avi versions listed above.
  • Immediate Action: Patch now; assume any reachable admin path could be targeted if credentials are compromised.
  • Mitigation: Move to 32.1.2, 31.2.2-2p3, or 30.2.7.

CVE-2026-47867: VMware Avi control-plane code execution

  • Impact: A malicious network user may access the Avi Control Plane and execute code remotely.
  • Affected Systems: Same affected Avi versions listed above.
  • Immediate Action: Prioritize internet-facing or broadly reachable Avi management deployments and remove unnecessary access paths now.
  • Mitigation: Upgrade to the fixed release for your branch: 32.1.2, 31.2.2-2p3, or 30.2.7.

CVE-2026-47866: VMware Avi authorization bypass

  • Impact: Attackers on the network may access a limited subset of the Avi Control Plane without proper authorization.
  • Affected Systems: Same affected Avi versions listed above.
  • Immediate Action: Treat this as an access-control failure: review who can reach Avi management, then patch and tighten network segmentation immediately.
  • Mitigation: Apply the vendor-fixed builds: 32.1.2, 31.2.2-2p3, or 30.2.7.

CVE-2026-47868: VMware Avi local privilege escalation

  • Impact: A local attacker may escalate privileges to root.
  • Affected Systems: Same affected Avi versions listed above.
  • Immediate Action: Investigate any shared access, break-glass accounts, or local shell access on Avi nodes; then patch without delay.
  • Mitigation: Upgrade to 32.1.2, 31.2.2-2p3, or 30.2.7.

CVE-2026-47870: VMware Avi privilege escalation leading to code execution

  • Impact: A malicious authenticated network user may gain elevated access and execute remote code.
  • Affected Systems: Same affected Avi versions listed above.
  • Immediate Action: Assume authenticated users are a viable attack path; rotate any exposed credentials and patch the platform now.
  • Mitigation: Install the fixed release for your branch: 32.1.2, 31.2.2-2p3, or 30.2.7.

Previously Alerted

What to Do Now

  1. Patch VMware Avi Load Balancer immediately to the fixed build for your branch. If you cannot patch today, isolate management access and disable any unnecessary admin exposure.
  2. Inventory all Avi deployments and confirm whether they are on 32.1.1, 31.1.1-31.2.2, 30.1.1-30.2.6, or 22.1.1-22.1.7.
  3. Verify exposure by checking which systems can reach the Control Plane and whether any non-admin users have authenticated access.
  4. Look for signs of abuse: unexpected config changes, new admin sessions, unusual file access, and unexplained process execution.
  5. Rotate credentials for Avi admins and service accounts if there is any chance of compromise.

Verification steps: confirm the installed version, compare it to the fixed release, and validate that the upgrade completed on every node in the cluster. Recheck access controls after patching.

Monitoring recommendations: watch for failed logins, new sessions, file path anomalies, unexpected API calls, control-plane changes, and root-level process activity. Increase alerting on any Avi management interface reachable from broader internal networks.

Related Resources

  • Internal blog posts: upcoming analysis on Avi Load Balancer hardening and emergency patch validation.
  • Official vendor advisories: VMware/Broadcom security advisories for Avi Load Balancer; follow the vendor bulletin for exact fixed build guidance.

Keep reading