Authenticated Code Injection in VMware Avi Load Balancer

VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute code. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

VMware Avi Load Balancer contains a critical remote code execution vulnerability (CVE-2026-47869, CVSS 8.7) that allows authenticated users with network access to inject and execute arbitrary code. This vulnerability affects multiple versions across the product line, from legacy 22.1.x through current 32.1.x releases, making it a widespread concern for organizations deploying Avi as their load balancing infrastructure. Load balancers are critical chokepoints in network architecture, handling authentication, traffic routing, and SSL/TLS termination—making compromise of these systems particularly severe. An attacker exploiting this vulnerability could gain persistent code execution within the network perimeter, potentially intercepting encrypted traffic, impersonating legitimate services, or pivoting to internal systems.

Casky.ai's 322 mapped security skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK Initial Access (TA0001) and Persistence (TA0043) techniques. Practitioners using Casky would identify suspicious patterns such as: authentication attempts followed by unusual code injection payloads in Avi API requests, anomalous script execution or binary spawning from Avi processes, unexpected outbound connections from the load balancer initiating command-and-control communication, and persistence mechanisms like scheduled tasks or service modifications on the Avi controller. The platform's skill coverage enables detection of both exploitation attempts and post-compromise behavior, helping security teams correlate web traffic logs, API audit trails, and system execution telemetry to catch attackers during the Initial Access phase or detect established persistence before lateral movement occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-47869.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-47869

Casky has 322 skills that investigate the attack patterns behind CVE-2026-47869. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn