CVE-2026-47868

VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate their privileges to run code as root. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:broadcom:vmware_avi_load_balancer::::::::
	cpe:2.3:a:broadcom:vmware_avi_load_balancer::::::::
	cpe:2.3:a:broadcom:vmware_avi_load_balancer::::::::
	cpe:2.3:a:broadcom:vmware_avi_load_balancer:31.2.2:-::::::
	cpe:2.3:a:broadcom:vmware_avi_load_balancer:31.2.2:2p1::::::
	cpe:2.3:a:broadcom:vmware_avi_load_balancer:31.2.2:2p2::::::
	cpe:2.3:a:broadcom:vmware_avi_load_balancer:32.1.1:::::::*

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) VMware Avi Load Balancer contiene una vulnerabilidad de escalada de privilegios local. Un usuario malintencionado con acceso local podría ser capaz de escalar sus privilegios para ejecutar código como root. Versiones afectadas: 32.1.1 (corregido en 32.1.2) 31.1.1 hasta 31.2.2 (corregido en 31.2.2-2p3) 30.1.1 hasta 30.2.6 (corregido en 30.2.7) 22.1.1 hasta 22.1.7 (corregido en 30.2.7)

Information

Published : 2026-07-18 09:17

Updated : 2026-10-24 20:10

NVD link : CVE-2026-47868

Mitre link : CVE-2026-47868

CVE.ORG link : CVE-2026-47868

JSON object : View

Products Affected

broadcom

vmware_avi_load_balancer

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2026-47868", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47868", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-22T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "VMware", "product": "Avi Load Balancer", "versions": [{"status": "affected", "version": "32.1.1", "versionType": "custom"}, {"status": "affected", "version": "31.1.1", "versionType": "custom", "lessThanOrEqual": "31.2.2"}, {"status": "affected", "version": "30.1.1", "versionType": "custom", "lessThanOrEqual": "30.2.6"}, {"status": "affected", "version": "22.1.1", "versionType": "custom", "lessThanOrEqual": "22.1.7"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-18T09:17:08.627", "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@vmware.com", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate their privileges to run code as root.\n\nAffected versions:\n32.1.1 (fixed in 32.1.2)\n31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)\n30.1.1 through 30.2.6 (fixed in 30.2.7)\n22.1.1 through 22.1.7 (fixed in 30.2.7)"}, {"lang": "es", "value": "VMware Avi Load Balancer contiene una vulnerabilidad de escalada de privilegios local. Un usuario malintencionado con acceso local podr\u00eda ser capaz de escalar sus privilegios para ejecutar c\u00f3digo como root.\n\nVersiones afectadas:\n32.1.1 (corregido en 32.1.2)\n31.1.1 hasta 31.2.2 (corregido en 31.2.2-2p3)\n30.1.1 hasta 30.2.6 (corregido en 30.2.7)\n22.1.1 hasta 22.1.7 (corregido en 30.2.7)"}], "lastModified": "2026-10-24T20:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "243FCCB5-E71D-42EE-B634-18C3764D128F", "versionEndIncluding": "22.1.7", "versionStartIncluding": "22.1.1"}, {"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E9EADC5-BEE0-411D-8BA5-62EC1847D834", "versionEndExcluding": "30.2.7", "versionStartIncluding": "30.1.1"}, {"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3961AB50-8B9B-474D-8B25-F039F94BE703", "versionEndExcluding": "31.2.2", "versionStartIncluding": "31.1.1"}, {"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:31.2.2:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59DAB0A9-D0C2-465B-ADE0-9BB64DA9CB8D"}, {"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:31.2.2:2p1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83F16554-7961-4AFC-8324-E6FDE01A0BAF"}, {"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:31.2.2:2p2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD6ACD46-BBF6-4900-92C4-F4C77B979CF4"}, {"criteria": "cpe:2.3:a:broadcom:vmware_avi_load_balancer:32.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B1FF054-1986-4182-821B-93C0D8ABE41F"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}