CVE-2026-47870

HighCVSS 8.8/10Last modified Oct 24, 2026

Description

VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to execute remote code.

Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Jul 18, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-478718.8VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network CVE-2026-478738.0The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) ra CVE-2026-478745.3The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to CVE-2026-478759.8Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if CVE-2026-478769.3VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative CVE-2026-478776.1Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1 CVE-2026-478787.3DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInpu CVE-2026-478798.7Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Clo CVE-2026-47885.5IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.37 stores sensitive information in log files that could be read by a local user.CVE-2026-478805.4A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named CVE-2026-478817.5Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that CVE-2026-478828.3When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Sp