PT-2026-60428 · Vmware · Avi Load Balancer

CVE-2026-47871 · Published 2026-07-16 · Updated 2026-07-18

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware Avi Load Balancer versions 22.1.1 through 22.1.7 VMware Avi Load Balancer versions 30.1.1 through 30.2.6 VMware Avi Load Balancer versions 31.1.1 through 31.2.2 VMware Avi Load Balancer version 32.1.1

Description Flaws in file path validation allow authenticated network users to perform directory traversal attacks, enabling them to access files located outside the intended directory path.

Recommendations Update versions 22.1.1 through 22.1.7 to version 30.2.7. Update versions 30.1.1 through 30.2.6 to version 30.2.7. Update versions 31.1.1 through 31.2.2 to version 31.2.2-2p3. Update version 32.1.1 to version 32.1.2.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-47871

Affected Products

Avi Load Balancer

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-47871 · Security Note
• https://twitter.com/juy_lang/status/2077622425232269591 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2078420569695854637 · Twitter Post
• https://twitter.com/vulnipulse/status/2078408844582273343 · Twitter Post
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926 · Note