VMware released patches for various critical bugs affecting its multicloud application delivery platform.
Seven vulnerabilities in total were found in VMware Avi Load Balancer. The bugs range across authentication bypass vulnerability (CVE-2026-47865, CVE-2026-47866); remote code execution (CVE-2026-47867, CVE-2026-47869); and privilege escalation (CVE-2026-47868, CVE-2026-47870). Another exploit (CVE-2026-47871) was described as a directory traversal vulnerability in which attackers sidestep web server defenses to access restricted files outside a server's root folder.
Users were advised to upgrade to the latest version of the suite, VMware Avi Load Balancer 32.1.2. No in-the-wild exploitation of the bugs were reported by Broadcom.
Vulnerable VMware
A previous VMware vulnerability affecting VMware vCenter Server was flagged as a federal threat in January. The exploit allowed for remote code execution or privilege escalation through the use of a specially made network packet.
VMware vSphere also saw concern from authorities after a security briefing from the National Security Agency (NSA) revealed a backdoor exploit allowing actors to grab cloned virtual machine (VM) snapshots for credential extraction and create hidden, rogue VMs via vCenter servers and the VMware ESXI hypervisor.
A separate VMware exploitation campaign, meanwhile, saw attackers using a custom exploit chain to break out of a VMware guest VM and execute bad code on the ESXI hypervisor itself.
Both exploits linked to actors operating in a Chinese-speaking region.
Comments