Exploitation observed; activity peaked at 4 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism. Affected versions: 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
3 versions affected across 1 product
| Date | Total | Labels |
|---|
| 2026-07-14 | 2 | Patch2 |
| 2026-07-15 | 4 | Disclosure1Patch3 |
| 2026-07-16 | 1 | Patch1 |
| 2026-07-18 | 4 | Disclosure2Patch2 |
| 2026-07-19 | 1 | Patch1 |
| 2026-07-20 | 2 | Patch2 |
| 2026-07-24 | 1 | General1 |
| 2026-07-29 | 1 | Patch1 |
| 2026-07-30 | 1 | Disclosure1 |
| 2026-08-02 | 1 | Patch1 |
| 2026-08-15 | 1 | Disclosure1 |
The VMware Avi Load Balancer Authentication Bypass Vulnerability (CVE-2026-47865) looks promising :D
Post summary
The tweet announces a new authentication‑bypass vulnerability (CVE‑2026‑47865) without additional technical or exploit details.
Broadcom has patched seven vulnerabilities in VMware Avi Load Balancer under VMSA-2026-0005. The main one is CVE-2026-47865 at 9.8. Network access to the Controller is enough to bypass authentication and reach the Avi Control plane. Also in the set: a second auth bypass at 8.3, two RCEs at 8.7, directory traversal at 8.8. 31.x goes to 31.2.2-2p3, 30.x to 30.2.7. There is no patch for 22.1.x, so those need to move to 30.2.7. No public exploit yet, but the Control plane holds policy for everything behind it. Broadcom lists no workarounds. Full Advisory: https://app.transilience.cloud/run-history/eb9c8a0a-5a22-42a0-84b9-05c4cbd45d13?file=reports%2Fproducts%2FVMware_Avi_Load_Balancer__CVE-2026-47865__vmware_avi_load_balancer__cve-2026-47865__report.pdf
Post summary
The advisory details patch availability and technical specifics for CVE‑2026‑47865 and related flaws, confirming the release of vendor fixes but no public exploitation or PoC code has been disclosed.
Warning: #Broadcom warns about vulnerabilities affecting #VMware #Avi Load Balancer. #CVE-2026-47865 enables authentication bypass and could be chained with other vulnerabilities for further compromise #RCE #EoP. More info at: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926 #Patch #Patch #Patch
Post summary
Broadcom warns that CVE-2026‑47865 permits authentication bypass on VMware Avi Load Balancer, with a patch available via the supplied advisory.
🚨 VMware Avi Load Balancer hit with critical bugs: CVE-2026-47869/47867 (auth'd RCE), CVE-2026-47868 (local priv-esc to root), CVE-2026-47865/47866 (auth/authz bypass). Also: CVE-2026-53994 ProFTPD heap overflow. Patch now. Details http://exploitgrid.net #CVE #InfoSec
Post summary
The tweet announces multiple critical CVEs affecting VMware Avi Load Balancer and ProFTPD, noting a patch is available and providing a link for further details, but does not mention active exploitation or provide a PoC.
VMware Avi Load Balancer patches CVE-2026-47865 (CVSS 9.8), a critical authentication bypass, plus six more flaws. Upgrade the Avi Controller now. #VMware #AviLoadBalancer #CVE202647865 #AuthenticationBypass #CyberSecurity http://securityonline.info/vmware-avi-load-balancer-cve-2026-47865/
Post summary
The post announces VMware Avi Load Balancer’s patch for critical authentication bypass CVE-2026-47865 and urges users to upgrade the Avi Controller to remediate the vulnerability.
【緊急】CVE-2026-47865 VMware Avi Load Balancer 31.1.1 から 31.2.2、30.1.1 から 30.2.6、22.1.1 から 22.1.7に深刻な脆弱性｜即時対応が必要 https://www.cybernote.click/2026/07/25/cve-2026-47865-vmware-avi-load-balancer-3111-31223011-30262211-2217/ #IT #Security #cybersecurity
Post summary
The post announces a critical vulnerability (CVE‑2026‑47865) affecting multiple versions of VMware Avi Load Balancer and urges immediate action, but does not provide patch info, exploit code, or evidence of active exploitation.
VMSA-2026-0005: VMware Avi Load Balancer addresses multiple vulnerabilities (CVE-2026-47865, CVE-2026-47866, CVE-2026-47867, CVE-2026-47868, CVE-2026-47869, CVE-2026-47870, CVE-2026-47871) https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926
Post summary
The advisory announces a patch for several VMware Avi Load Balancer CVEs, providing only identifiers and a support link without any exploit or technical details.
🚨SonicWall SMAアプライアンスがゼロデイ攻撃の標的に（CVE-2026-15409、CVE-2026-15410） 🔨VMware Avi Load Balancerの深刻な脆弱性7件が修正される（CVE-2026-47865、CVE-2026-47866他） 〜サイバーアラート7月15日〜 https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/46662/
Post summary
Security alert announces SonicWall SMA appliances are targeted by new zero‑day CVEs (CVE‑2026‑15409/15410) and reports that seven critical VMware Avi Load Balancer vulnerabilities (CVE‑2026‑47865/47866) have been patched.
🚨 CVE-2026-47865: VMware Avi Load Balancer has patched a critical authentication bypass vulnerability (CVSS 9.8), along with six additional security flaws. Upgrade the Avi Controller now. #CyberSecurity #CVE #VMware #ThreatWire
Post summary
The message announces that VMware has patched CVE‑2026‑47865, a critical authentication bypass flaw in the Avi Load Balancer, and urges users to upgrade immediately.
CVE-2026-47865: VMware Avi Load Balancer Authentication Bypass - What It Means for Your Business and How to Respond https://hubs.li/Q04t7rbw0
Post summary
The article announces CVE‑2026‑47865, an authentication bypass flaw in VMware Avi Load Balancer, providing basic technical details but no evidence of PoC, exploit code, active exploitation, or patch information.
⚠️ Broadcom publico parches para siete vulnerabilidades severas en VMware Avi Load Balancer, afectando versiones 22.1.x a 32.1.x. La mas critica, CVE-2026-47865 con CVSS 9.8, permite a un atacante con acceso de red saltarse por completo la autenticacion y tomar control del Avi Control Plane, mientras CVE-2026-47867 habilita ejecucion remota de codigo con CVSS 8.7. No hay explotacion activa confirmada al momento de la publicacion, pero cualquier equipo que use este balanceador de carga en produccion deberia parchar de inmediato. https://www.securityweek.com/7-severe-vulnerabilities-patched-in-vmware-avi-load-balancer/ #VMware #Ciberseguridad #Vulnerabilidad Quieres conocer novedades tecnologicas? Sigue @smarteck_cl Tambien te seguiremos 🤝🏻
Post summary
Broadcom has released patches for seven severe VMware Avi Load Balancer vulnerabilities, including CVE-2026-47865 and CVE-2026-47867, with no confirmed active exploitation and a call to patch immediately.
Broadcom has patched critical vulnerabilities in VMware Avi Load Balancer, including an authentication bypass flaw (CVE-2026-47865) with a CVSS score of 9.8. Users should upgrade to version 32.1.2 to mitigate risks. #CyberSecurity #VMware #AviLoadBalancer #CyberSecurity #VMware #AviLoadBalancer #SecurityUpdate #Vulnerability #Patch #ITSecurity https://thedailytechfeed.com/vmware-patches-critical-avi-load-balancer-vulnerabilities/
Post summary
Broadcom has released a patch for VMware Avi Load Balancer, directing users to upgrade to version 32.1.2 to address the critical authentication bypass flaw CVE‑2026‑47865 (CVSS 9.8).
⚠️ Vulnerabilidades en productos VMware ❗ CVE-2026-47871 ❗ CVE-2026-47869 ❗ CVE-2026-47865 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-vmware-6/ https://t.co/Mp2j9dqAcM
Post summary
The tweet lists three VMware CVEs and provides links for more information, but offers no details on exploitation, patches, or technical characteristics.
Avi Load Balancer: CVE-2026-47865 auth bypass, CVSS 9.8. Network reach to the controller can bypass auth to the control plane (VMSA-2026-0005). Update: 31.2.2-2p3 / 30.2.7 (22.1.x -> 30.2.7). Prefer 32.1.2. Restrict mgmt access. https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926
Post summary
Broadcom releases patch guidance for CVE‑2026‑47865 auth bypass, specifying affected versions and recommending mgmt access restriction.
CVE-2026-47865 (CVSS 9.8): VMware Avi Load Balancer auth bypass via network access. Review controls if you use Avi. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/aRncqyopkp
Post summary
A high‑severity authentication bypass vulnerability (CVE-2026‑47865) has been disclosed for VMware Avi Load Balancer; users should review and strengthen controls.
🚨 CRITICAL - VMware Avi Load Balancer Control Plane Authentication Bypass (CVE-2026-47865) VMware Avi Load Balancer contains an authentication bypass in the Avi Controller (control plane) that allows unauthenticated access to management interfaces. The root cause is an authentication/authorization logic flaw (improper authentication) that fails to correctly enforce identity checks before granting control plane access. An attacker with network access to the Avi control plane can exploit this remotely by sending crafted requests to bypass the authentication mechanism, with no valid credentials required. Successful exploitation can lead to full compromise of the load balancer management plane, including configuration takeover, service disruption, and potential downstream access to applications and traffic handling. 👉 Affected: VMware Avi Load Balancer 31.1.1–31.2.2, 30.1.1–30.2.6, 22.1.1–22.1.7 | Upgrade to 31.2.2-2p3 or 30.2.7
Post summary
The advisory details a critical authentication bypass (CVE-2026-47865) in VMware Avi Load Balancer that permits unauthenticated access. It recommends upgrading to the latest patched versions and does not report active exploitation or provide PoC code.
CVE-2026-47865 Authentication Bypass in VMware Avi Load Balancer Versions 22.1.1 Through 31.2.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-47865
Post summary
The post announces an authentication bypass vulnerability (CVE‑2026‑47865) affecting VMware Avi Load Balancer versions 22.1.1‑31.2.2, providing basic technical details but no mitigations or evidence of exploitation.
⚠️ VMware Avi Load Balancer alert: CVE-2026-47865 (CVSS 9.8) Attackers could bypass authentication. Upgrade to a vendor-listed fixed release. https://vulnipulse.com/advisories/vmware-cve-2026-47865 #VMware #AviLoadBalancer #CyberSecurity #CVE
Post summary
The post announces CVE‑2026-47865, an authentication bypass in VMware Avi Load Balancer, and urges users to upgrade to the vendor‑issued fix; no PoC or exploit details are provided.
🚨 Broadcom patches 7 severe flaws in VMware Avi Load Balancer, including a critical auth bypass 🔹 CVE-2026-47865: critical authentication bypass grants access to the Avi control plane 🔹 Other flaws enable RCE, privilege escalation to root & directory traversal 🔹 Discovered by researchers from NATO's cyber hub & Viettel IDC 🔹 No exploitation seen yet — but VMware flaws are frequent attacker targets, patch now
Post summary
Broadcom released patches for seven severe flaws in VMware Avi Load Balancer, including a critical authentication bypass, and urges immediate action.
16 of 16 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | broadcom | vmware_avi_load_balancer | - | - | - |
| App | broadcom | vmware_avi_load_balancer | 22.1.7 | - | - |
| App | broadcom | vmware_avi_load_balancer | 22.1.7 | - | - |
| App | broadcom | vmware_avi_load_balancer | 22.1.7 | - | - |
| App | broadcom | vmware_avi_load_balancer | 22.1.7 | - | - |
| App | broadcom | vmware_avi_load_balancer | 22.1.7 | - | - |
| App | broadcom | vmware_avi_load_balancer | 22.1.7 | - | - |
| App | broadcom | vmware_avi_load_balancer | 22.1.7 | - | - |
| App | broadcom | vmware_avi_load_balancer | 22.1.7 | - | - |
| App | broadcom | vmware_avi_load_balancer | 22.1.7 | - | - |
| App | broadcom | vmware_avi_load_balancer | 22.1.7 | - | - |
| App | broadcom | vmware_avi_load_balancer | 22.1.7 | - | - |
| App | broadcom | vmware_avi_load_balancer | 31.2.2 | - | - |
| App | broadcom | vmware_avi_load_balancer | 31.2.2 | - | - |
| App | broadcom | vmware_avi_load_balancer | 31.2.2 | - | - |
| App | broadcom | vmware_avi_load_balancer | 32.1.1 | - | - |