VMware Avi Load Balancer contains a remote code execution vulnerability identified as CVE-2026-47869. This vulnerability arises from improper control of code generation, enabling a malicious authenticated user with network access to inject and execute arbitrary code. The affected versions include 22.1.1 through 22.1.7, 30.1.1 through 30.2.6, 31.1.1 through 31.2.2, and 32.1.1. Fixes have been released in versions 30.2.7, 31.2.2-2p3, and 32.1.2 respectively.

Successful exploitation of this vulnerability could allow an authenticated user to execute arbitrary code remotely on the VMware Avi Load Balancer, potentially leading to full compromise of the affected system's confidentiality and integrity. Availability impact is not indicated. The CVSS v3.1 base score is 8.7 (High), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality and integrity.

Fixes are available and should be applied promptly. Upgrade affected VMware Avi Load Balancer versions to 30.2.7 or later for the 30.x branch, 31.2.2-2p3 or later for the 31.x branch, and 32.1.2 or later for the 32.x branch. Since this is not a cloud service, remediation requires customer action to update the software. Patch status is confirmed by the fixed versions stated in the description.