CVE-2026-47865

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism.

Affected versions: 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Jul 18, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-478668.3VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the CVE-2026-478678.8VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi CVE-2026-478687.8VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate the CVE-2026-478698.8VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to i CVE-2026-478708.8VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to ex CVE-2026-478718.8VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network CVE-2026-478738.0The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) ra CVE-2026-478745.3The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to CVE-2026-478759.8Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if CVE-2026-478769.3VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative CVE-2026-478776.1Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1 CVE-2026-478787.3DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInpu