VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism. Affected versions: 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.8 · broadcomNVD modified 2026-10-24 20:10
Affected (CPE criteria) 16
cpe:2.3:a:broadcom:vmware_avi_load_balancer:*:*:*:*:*:*:*:*cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:-:*:*:*:*:*:*cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p10:*:*:*:*:*:*cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p11:*:*:*:*:*:*cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p2:*:*:*:*:*:*cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p3:*:*:*:*:*:*cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p4:*:*:*:*:*:*cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p5:*:*:*:*:*:*cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p6:*:*:*:*:*:*cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p7:*:*:*:*:*:*cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p8:*:*:*:*:*:*cpe:2.3:a:broadcom:vmware_avi_load_balancer:22.1.7:2p9:*:*:*:*:*:*cpe:2.3:a:broadcom:vmware_avi_load_balancer:31.2.2:-:*:*:*:*:*:*cpe:2.3:a:broadcom:vmware_avi_load_balancer:31.2.2:2p1:*:*:*:*:*:*cpe:2.3:a:broadcom:vmware_avi_load_balancer:31.2.2:2p2:*:*:*:*:*:*cpe:2.3:a:broadcom:vmware_avi_load_balancer:32.1.1:*:*:*:*:*:*:*