CVE-2026-47866: Authorization Bypass in VMware Avi Load Balancer

Overview

Broadcom disclosed CVE-2026-47866, an authorization bypass vulnerability in VMware Avi Load Balancer, on July 18, 2026. Assigned a CVSS score of 8.3 (High), this flaw allows a low-privileged authenticated attacker with network access to bypass authorization controls and access a limited subset of the Avi Control Plane without appropriate permissions.

While not as severe as the concurrent authentication bypass (CVE-2026-47865), this vulnerability is significant in a chained attack scenario and represents a meaningful access control failure within the product.

Technical Details

The vulnerability is classified as CWE-863 (Incorrect Authorization), meaning the application fails to enforce proper authorization checks when granting access to protected resources. Unlike the companion CVE-2026-47865 (which requires no credentials), this flaw requires a low-privilege authenticated session to exploit—but the required privilege level is minimal and may be obtainable through other means, including the authentication bypass.

The impact profile includes high confidentiality and high integrity impact, with low availability impact, indicating an attacker could read sensitive configuration data and make unauthorized modifications within the accessible scope.

Affected Versions

Role in the Vulnerability Chain

CVE-2026-47866 is the least severe of the four VMware Avi Load Balancer vulnerabilities disclosed on July 18, 2026, but it plays an important role in attack escalation:

An attacker who gains initial foothold via the auth bypass can use this authorization bypass to expand their access before leveraging one of the two RCE flaws, making this CVE a meaningful link in a full compromise chain.

Risk Assessment

In isolation, CVE-2026-47866 requires a low-privilege authenticated account. However, organizations should not use this as a reason to deprioritize patching:

• The companion authentication bypass (CVE-2026-47865) can be chained to obtain that initial foothold without credentials
• The "limited subset" of accessible Control Plane resources may include sensitive configuration data or credentials that enable further escalation
• The high integrity impact means unauthorized modifications to routing or policy configurations are possible

In environments with strict internal authentication controls but unpatched systems, this flaw could also be exploited by malicious insiders with minimal access.

Remediation

Broadcom has released patches across all affected version branches. No workarounds are documented.

Upgrade path:

• If running 22.1.x or 30.1.x–30.2.6: upgrade to 30.2.7
• If running 31.1.x–31.2.2: upgrade to 31.2.2-2p3
• If running 32.1.1: upgrade to 32.1.2

Apply the full patch bundle that addresses all four CVEs simultaneously.

Recommendations

1. Apply all four patches as a bundle: CVE-2026-47866 is patched by the same update that addresses the RCE and auth bypass vulnerabilities. Apply them together.
2. Audit low-privilege accounts: Review which users have low-level authenticated access to the Control Plane. Reduce the attack surface by removing unnecessary accounts.
3. Monitor for anomalous access: Look for low-privilege user accounts accessing resources outside their expected scope in Control Plane audit logs.
4. Network segmentation: Even after patching, restricting Control Plane network access to management networks is a defense-in-depth best practice.

References

• NVD Entry — CVE-2026-47866
• NVD Entry — CVE-2026-47865 (critical auth bypass)
• NVD Entry — CVE-2026-47867 (companion RCE)
• NVD Entry — CVE-2026-47869 (companion RCE)
• Broadcom Support Portal Advisory (authentication required)