VMware Avi Load Balancer: Critical loophole allows bypass of the login

VMware has issued security updates for its Avi Load Balancer after multiple critical vulnerabilities were discovered that could allow attackers to bypass authentication mechanisms. The flaws, which affect several versions of the product, have been classified with high and critical risk ratings, according to a security advisory released by Broadcom, the company behind Avi. The most severe vulnerability, designated CVE-2026-47865, allows malicious actors with network access to bypass the authentication process on the Avi Controller interface. This means unauthorized users could gain entry to sensitive systems without needing valid credentials. While Broadcom did not provide detailed information on how exactly the flaw can be exploited or where it was located within the system architecture, the severity rating indicates a serious threat. Other notable issues include a directory traversal vulnerability (CVE-2026-47871), a code smuggling flaw in the Avi Controller (CVE-2026-47867), and a vulnerability that enables authenticated users to inject and execute malicious code (CVE-2026-47869). These flaws collectively pose a substantial risk to the integrity and confidentiality of data managed by the load balancer. Additionally, attackers could potentially access certain settings on the Avi Controller without authorization (CVE-2026-47866). Users with local access might also expand their privileges and run code as a root user (CVE-2026-47868). Even malicious users who are already logged into the system from the network could exploit this flaw (CVE-2026-47870). These vulnerabilities highlight the need for immediate patching to prevent potential breaches. Broadcom’s developers have released updated software versions to address these issues. Affected customers using versions of the Avi Load Balancer prior to 32.1.2, 31.2.2-2p3, or 30.2.7 are advised to upgrade to one of these patched versions. Specifically, users running versions 22.1.1 through 22.1.7 should migrate to version 30.2.7 to ensure they are protected against known exploits. This update follows a previous round of security advisories from Broadcom in early June, which identified cross-site scripting vulnerabilities in products such as VMware Cloud Foundation. Those issues were rated as high-risk but did not reach the level of criticality seen in the current set of flaws. In response, Broadcom distributed updated software to mitigate those risks. The discovery of these vulnerabilities underscores the importance of regular software maintenance and timely patch application, especially for enterprise-grade infrastructure components like load balancers. Organizations relying on Avi Load Balancer must assess their current deployment status and apply the necessary patches to safeguard their networks from potential exploitation. As the cybersecurity landscape continues to evolve, proactive measures remain essential in defending against emerging threats.