Broadcom patches seven Avi Load Balancer vulnerabilities

Broadcom announced on Tuesday that it has released patches for seven vulnerabilities in VMware Avi Load Balancer. The company said the flaws affect the Avi control plane and could allow attackers with network or local access to bypass authentication, execute code or escalate privileges.

Broadcom credited Filip Waeytens of NATO’s technology and cyber hub with discovering CVE-2026-47865, a critical authentication bypass that can be triggered by an attacker with network access. Waeytens is also credited with three high-severity issues tracked as CVE-2026-47866, CVE-2026-47867 and CVE-2026-47868, which Broadcom says can enable authentication bypass, arbitrary code execution and privilege escalation to root when exploited.

Lang Khuong Duy of Viettel IDC is credited with two high-severity vulnerabilities: CVE-2026-47871, a directory traversal bug, and CVE-2026-47870, a privilege escalation flaw. Broadcom credited both researchers for responsibly reporting CVE-2026-47869, a high-severity remote code execution vulnerability that requires an authenticated attacker with network access.

The advisory notes that exploitation requires either network or local access; some issues require valid authentication while others allow privilege escalation after initial access. Broadcom did not report any instances of in-the-wild exploitation in the advisory and recommends that organizations install the provided updates.

VMware Avi Load Balancer is a software-defined platform that provides load balancing, application security and analytics for applications running in hybrid and multi-cloud environments. Because the product manages traffic between users and applications, Broadcom said flaws in its control plane or management interfaces can have operational and security implications.

Administrators responsible for Avi deployments should consult Broadcom’s full advisory for affected versions and follow the vendor’s remediation steps, including applying patches or vendor-recommended workarounds.