VMware Avi Load Balancer contains an authentication bypass vulnerability (CVE-2026-47865) that enables an attacker with network access to circumvent the authentication mechanism and gain unauthorized access to the Avi Control plane. The vulnerability affects multiple version ranges: 22.1.1 through 22.1.7, 30.1.1 through 30.2.6, and 31.1.1 through 31.2.2. Remediation is provided in fixed versions 30.2.7 and 31.2.2-2p3. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker with network access to bypass authentication controls and gain full access to the Avi Control plane. This can lead to complete compromise of the load balancer's management functions, potentially impacting confidentiality, integrity, and availability of the system and associated network traffic.

Fixed versions are available: 30.2.7 and 31.2.2-2p3. Users should upgrade affected VMware Avi Load Balancer installations to these versions or later to remediate the vulnerability. Patch status is confirmed by the provided affected version ranges and fixed versions. No vendor advisory content was provided to indicate alternative mitigations or that no action is required.