Seven Security Flaws Fixed in VMware Avi Load Balancer, One Rated Critical
Broadcom has patched a critical flaw that lets attackers break into a core networking component without a password, plus six more serious bugs found by two outside researchers.
Key points
- Broadcom patched seven vulnerabilities in VMware Avi Load Balancer on Tuesday, including one rated critical.
- CVE-2026-47865, the most serious flaw, carries a critical severity rating and lets an attacker break in without any password over a network connection.
- Filip Waeytens of NATO's technology and cyber hub discovered four of the seven flaws; Lang Khuong Duy of Viettel IDC found two, and both researchers share credit for a seventh.
- No active attacks exploiting any of these vulnerabilities have been reported as of Broadcom's advisory.
- Organisations running VMware Avi Load Balancer should apply the latest updates immediately.
Broadcom, the company that owns VMware, shipped security updates on Tuesday for VMware Avi Load Balancer, a platform that spreads internet traffic across multiple servers so no single machine gets overwhelmed. It sits at a chokepoint in many corporate networks, which makes it a valuable target.
Two independent researchers found all seven vulnerabilities fixed in one go.
The worst is CVE-2026-47865, rated critical. It's an authentication bypass: an attacker with network access can walk straight past the login screen and into the Avi control plane, the part of the system that manages all traffic routing decisions. Filip Waeytens, a researcher at NATO's technology and cyber hub, discovered it.
Waeytens also found three high-severity flaws tracked as CVE-2026-47866, CVE-2026-47867 and CVE-2026-47868. They'd let an attacker bypass authentication, run arbitrary code, or escalate privileges to root (full administrator control). Network or local access is required for each.
Lang Khuong Duy of Vietnamese security firm Viettel IDC found two additional high-severity bugs. CVE-2026-47871 enables a directory traversal attack, where an intruder tricks the software into reading files outside the folders it should touch. CVE-2026-47870 covers privilege escalation.
Both researchers share credit for CVE-2026-47869, a high-severity remote code execution flaw, meaning an attacker can run any command they choose on a target machine across a network. An authenticated session is required first, which raises the bar slightly.
Should organisations be worried right now?
Broadcom's advisory lists no evidence of active exploitation. That's good news, but it isn't a reason to wait. Attackers routinely study freshly published patches, reverse-engineer what was broken, and build exploit tools within days. We covered a similar authentication-bypass scenario without a password in our RabbitMQ story on 13 July, and the pattern is consistent: the window between patch and weaponised exploit keeps shrinking.
If your organisation runs VMware Avi Load Balancer, the security team shouldn't be reading about this. They should be patching.
