CVE-2026-47866 is an authorization bypass vulnerability in VMware Avi Load Balancer. It allows an attacker with network access to bypass authorization controls and access a limited subset of the Avi Control Plane. The vulnerability affects versions 22.1.1 through 22.1.7, 30.1.1 through 30.2.6, 31.1.1 through 31.2.2, and 32.1.1. VMware has fixed the issue in versions 30.2.7, 31.2.2-2p3, and 32.1.2.

Successful exploitation could lead to unauthorized access to parts of the Avi Control Plane, potentially allowing an attacker to view or manipulate sensitive configuration or operational data. The CVSS v3.1 base score is 8.3 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality and integrity impact with low availability impact.

Upgrading to the fixed versions is recommended: 30.2.7 or later for the 30.x branch, 31.2.2-2p3 or later for the 31.x branch, and 32.1.2 or later for the 32.x branch. Since the vendor advisory or patch links are not explicitly provided, confirm patch availability and upgrade guidance from VMware's official security advisories before applying updates.