CVE-2026-47870 is a privilege escalation vulnerability in VMware Avi Load Balancer. An authenticated user with network access could exploit this flaw to execute remote code on the affected system. The vulnerability impacts versions 22.1.1 through 22.1.7, 30.1.1 through 30.2.6, 31.1.1 through 31.2.2, and version 32.1.1. Fixes have been released in versions 30.2.7, 31.2.2-2p3, and 32.1.2 respectively. There is no indication of known exploits in the wild at this time.

Successful exploitation allows a malicious authenticated user to escalate privileges and execute remote code, potentially compromising confidentiality and availability of the system. The CVSS vector indicates network attack vector with low attack complexity, requiring privileges but no user interaction, and resulting in high confidentiality impact and low availability impact.

Upgrading to the fixed versions is the recommended remediation: 22.1.8 or later (implied by fix in 30.2.7), 30.2.7 or later, 31.2.2-2p3 or later, and 32.1.2 or later. Patch status is confirmed by the version fixes listed. No vendor advisory content was provided to indicate alternative mitigations or no-action status.