← Vulnerability feed

Vulnerability record · CVE-2026-47870 · published 18 July 2026

CVE-2026-47870: Broadcom vmware avi load balancer improper privilege management vulnerability

Broadcom · Vmware Avi Load Balancer

VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to execute remote code. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

8.8 CVSS 3.1 High EPSS 0.42% · top 66.5% CWE-269 · Improper privilege management
8.8CVSS 3.1 base score
0.42%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
20 Aug 2026Last modified by NVD

Description

VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to execute remote code. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926 Vendor Advisory

Track CVE-2026-47870 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-47865Broadcom vmware avi load balancer improper authentication vulnerabilityVMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control …EPSS 0.61%8.8CVE-2026-47867Broadcom vmware avi load balancer code injection vulnerabilityVMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi Control p…EPSS 0.74%8.8CVE-2026-47869Broadcom vmware avi load balancer code injection vulnerabilityVMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and…EPSS 0.74%8.8CVE-2026-47871Broadcom vmware avi load balancer path traversal vulnerabilityVMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to …EPSS 0.96%8.3CVE-2026-47866Broadcom vmware avi load balancer incorrect authorization vulnerabilityVMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Cont…EPSS 0.38%7.8CVE-2026-47868Broadcom vmware avi load balancer improper privilege management vulnerabilityVMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate their privil…EPSS 0.14%9.9CVE-2026-84869ScreenConnect client allows unauthorized file transfer and execution in remote sessionsA flaw in the ConnectWise ScreenConnect client lets files be transferred and executed inside an active remote session without authorization or Host c…KEVEPSS 0.92%analysed9.8CVE-2026-46817Oracle E-Business Suite Payments missing authentication allows takeoverOracle Payments in Oracle E-Business Suite 12.2.3 through 12.2.15 contains an easily exploitable flaw in the File Transmission component. An unauthen…KEVEPSS 0.81%analysed

Source: NIST National Vulnerability Database (record CVE-2026-47870), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.