VMware Avi Load Balancer Remote Code Execution Vulnerability

VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi Control plane and execute code remotely. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-47867 is a critical remote code execution vulnerability in VMware Avi Load Balancer that allows unauthenticated or low-privileged attackers with network access to the Control plane to execute arbitrary code. Load balancers are critical infrastructure components that sit at network perimeters, making this vulnerability particularly dangerous—successful exploitation could grant attackers immediate access to internal networks and the ability to pivot laterally. Organizations running affected versions (primarily 22.1.x, 30.x, and 31.x releases) face significant risk, especially if their Avi Control plane is accessible from untrusted networks. The CVSS score of 8.7 reflects the severity of unauthenticated remote code execution in a widely-deployed network appliance.

Casky.ai's 322 mapped security skills enable practitioners to detect the attack patterns underlying this vulnerability by correlating activity against MITRE ATT&CK Reconnaissance (TA0001) and Resource Development (TA0043) techniques alongside the execution methods triggered during exploitation. When Claude AI analyzes telemetry from Avi deployments, practitioners would observe skills detecting network reconnaissance probing the Control plane API, anomalous authentication attempts, and suspicious command execution flows that precede code injection. The platform's extended reasoning capabilities help security teams recognize that seemingly benign Control plane queries may be reconnaissance for CWE-94 (Improper Control of Generation of Code, 'Code Injection'), allowing defenders to catch attackers in early reconnaissance phases before exploitation occurs. By mapping these behavioral patterns to the specific MITRE techniques in the exploit chain, Casky transforms raw security events into actionable intelligence that prioritizes patching and network segmentation of Avi infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-47867.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-47867

Casky has 322 skills that investigate the attack patterns behind CVE-2026-47867. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn