The vulnerability tracked as CVE-2025-22217, carries a CVSS severity score of 8.6/10.
The company described the security defect as an unauthenticated blind SQL Injection vulnerability and urged enterprise admins to apply available patches urgently as there are no pre-patch workarounds.
A high-risk bulletin from VMware warned that “a malicious user with network access could potentially use specially crafted SQL queries to gain access to the database.”
The VMware Avi Load is widely adopted to help organizations distribute and manage incoming traffic across multiple servers, ensuring reliable performance for cloud and on-premises applications. In addition to load balancing, it provides web application security and container ingress for cloud and data center applications.
The product is designed to work with traditional VM-based applications and container microservices.
VMware advises customers using Avi Load Balancer versions 30.1.1, 30.1.2, 30.2.1, and 30.2.2 to swiftly deploy the available patches. Administrators are encouraged to upgrade to at least version 30.1.2 or later before applying the patch if they are running older releases.
Currently, there are no known workarounds, so patching remains the only effective remedy.
