PSIRT Advisories

The Aviatrix Product Security Team continually tests the software product, looking for vulnerabilities and weaknesses. If you have a security issue to report, open a support ticket on the Aviatrix Support Portal. Any such findings are fed back to Aviatrix’s development teams and serious issues are described along with protective solutions in the advisories below. Note the following Aviatrix Security recommendations and communication plans:

• Aviatrix strongly recommend customers stay on the latest release to resolve features and bug issues. All fixes are in the new release; Aviatrix does not patch older release versions.
• Customers are strongly recommended to perform image migration 2x a year. The migration process provides the latest system level security patch.
• All known software vulnerabilities are submitted to Mitre for CVE-ID references by Aviatrix Systems.
• Aviatrix publishes Field Notices and send alerts to Controller Admin in the Controller console when security related issues are published.

​

CVE-2026-98432 (Linux Kernel TCP Vulnerability)

Date 11/05/2026 CVE # CVE-2026-98432: Race condition in the Linux kernel IPv4 TCP networking subsystem.

• Risk Rating: CVSS 9.8 (Critical), as rated by the Linux kernel security team.
• Description: CVE-2026-98432 is a race condition in the Linux kernel’s IPv4 TCP networking subsystem. Aviatrix Controllers, Gateways, and CoPilot run the Linux kernel and are affected.
• Impact: A remote, unauthenticated attacker could trigger a use-after-free memory error on an affected Controller, Gateway, or CoPilot instance. This type of memory error can lead to remote code execution and privilege escalation.

Affected Products Aviatrix Controller, Gateways, and CoPilot. Solution Aviatrix delivers the fix differently for the Controller, Gateways, and CoPilot. Controller: The Controller receives the kernel update from the upstream operating system vendor through unattended upgrades, so you do not need to upgrade the Aviatrix software first. Check the kernel version, reboot the Controller, and verify the kernel version as soon as you can (see steps 1 to 3 below). For more information about unattended upgrades, see the Unattended Upgrades page and the PeriodicUpdates page on the Debian Wiki. Gateways: All Gateways running 8.1.x or later are mitigated automatically after you upgrade the Controller to the fixed release. While you do not have to upgrade the Gateways for them to be protected, Aviatrix recommends as a best practice that you always upgrade them and make sure they run the same software version as the Controller. Schedule a maintenance window to upgrade the Controller and then the Gateways (see step 4 below). CoPilot: CoPilot is also affected. The upstream operating system vendor, Ubuntu, has not yet released the kernel fix for the CoPilot operating system. You can track the status on the Ubuntu CVE page. When the fix is available, CoPilot receives it through unattended upgrades, and you must reboot CoPilot for the fix to take effect. Aviatrix will update this advisory when the fix is available. Before You Begin Controller (steps 1 to 3)

• Make sure you can sign in to CoPilot. Controllers 8.x and 9.x that do not use CoPilot can use the Controller UI instead.
• Make sure you can sign in to your cloud service provider (CSP) console to reboot the Controller.
• Schedule a maintenance window for the Controller reboot in step 2. The reboot does not impact traffic flow.

Gateways (step 4)

• Schedule a maintenance window to upgrade the Controller and then the Gateways. You do not need to wait for it to complete steps 1 to 3.

​

Multiple PHP CVEs: CVE-2026-109618, CVE-2026-109619 (PHP2Shell), and CVE-2026-115560

Date 10/27/2026 CVE # CVE-2026-109618 and CVE-2026-109619 (“PHP2Shell”): Remote code execution vulnerabilities in PHP core that an unauthenticated attacker can trigger.

• Risk Rating: CVSS v4.0 9.2 (Critical) for each CVE.
• Description: The Aviatrix Controller uses PHP to serve its web UI and API, so Aviatrix treats the Controller as affected by both CVEs. Aviatrix Gateways and CoPilot do not include or run PHP and are not affected.
• Impact: A successful attack would allow an unauthenticated attacker to execute arbitrary code on the Controller.

Affected Products Aviatrix Controller. Solution The October 27, 2026 release (10.1.20, 10.0.20, 9.0.30, 8.2.40, 8.1.60, and 8.0.80) updates PHP for all supported Controller releases. For Controller 7.2 and earlier, Aviatrix is preparing a patch that automatically detects the specific release and applies the appropriate fix, either the full security patch or a risk-reducing mitigation, depending on what that release supports. Apply it using the standard procedure for Applying a Security Patch (see below section). Aviatrix recommends upgrading to a supported release as the permanent fix. If you have not already done so, take these steps today:

1. Restrict inbound access to the Controller and CoPilot so they are reachable only from trusted networks, such as your corporate CIDR ranges, a VPN, or a bastion/jump host. Until a Controller update is installed, this is the most effective way to protect your Controller, because these vulnerabilities can be exploited only by someone who can reach it.
2. Review the Platform Security Hardening Guidelines , which cover this and other platform best practices.

CVE # CVE-2026-115560 (PHP session upload progress)

• Description: PHP’s advisory states this issue can be triggered only when an application sets session.serialize_handler to php_binary or php_serialize, changes it to php at runtime, and makes that change before starting the session. The Aviatrix Controller does not use this pattern, so the conditions for exploitation are not met.

Affected Products None. The Aviatrix Controller cannot be exploited through this CVE, and Aviatrix Gateways and CoPilot do not run PHP and are not affected. Solution None required. The October 27, 2026 release does not include a fix for this CVE because the Controller cannot be exploited through it. This CVE is separate from PHP2Shell; users should still install the October 27, 2026 Controller release (10.1.20, 10.0.20, 9.0.30, 8.2.40, 8.1.60, or 8.0.80) to remediate CVE-2026-109618 and CVE-2026-109619.

​

CVE-2026-111497 (Brotli Decoder) and Related Node.js CVEs in Aviatrix CoPilot

Date 10/27/2026 CVE # CVE-2026-111497: Out-of-bounds write in the Brotli decoder bundled with Node.js.

• Risk Rating: High.
• Description: Aviatrix CoPilot is affected, but only an attacker who is already authenticated could reach the vulnerable code. An attacker who can supply Brotli data that CoPilot decompresses could corrupt process memory, which can lead to a crash, memory disclosure, or remote code execution.
• Impact: An authenticated attacker could crash the CoPilot process, disclose memory contents, or execute arbitrary code.

Affected Products Aviatrix CoPilot. Solution None required. CoPilot 4.38.1, released October 26, 2026, already includes the fix: it moves the Node.js runtime to version 24.22.1. That release also fixes the other nine CVEs in the same Node.js release: CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069 (High); CVE-2026-105481, CVE-2026-106072, and CVE-2026-106074 (Medium); and CVE-2026-106070, CVE-2026-106071, and CVE-2026-106073 (Low). CoPilot updates automatically, so no manual action is required. Aviatrix Gateways are not affected by CVE-2026-111497 directly, but scanners may report the operating system package libbrotli1 on gateways. The package is present only as a transitive dependency, and no gateway component decompresses Brotli data from untrusted sources, so the vulnerability is not reachable. Gateways version 8.1.0 and later install operating system updates automatically; no Aviatrix release is required. Allow time for the update to install, then rescan to confirm the finding has cleared.

​

Compromised eMudhra Intermediate Certificate Authorities

Date 10/27/2026 CVE # None assigned

• Risk Rating: Low for Aviatrix products.
• Description: On October 17, 2026, it was reported that the private keys for eight eMudhra intermediate certificates had been compromised. These keys could allow an attacker to issue fraudulent TLS certificates for websites they do not control. Trust store maintainers have since removed the eMudhra root certificate that signed the affected intermediates. See Protecting Firefox users following the compromise of eMudhra intermediate certificates.
• Impact: An attacker who can intercept a TLS connection could use a fraudulent certificate to impersonate a server that the connection trusts through the operating system trust bundle. On Aviatrix systems the exposure is limited:
  • Communication between Aviatrix components uses an Aviatrix internal certificate authority, and calls to Aviatrix services use mutual TLS with pinned Aviatrix keys. These connections do not rely on public certificate authorities and cannot be impersonated with the compromised certificates.
  • Very few connections made by Aviatrix systems rely on the system trust bundle. An attack on those connections would also require the attacker to intercept traffic on the network path between the Aviatrix system and the destination, which is difficult to achieve.

Affected Products Aviatrix Controller, Gateways, and CoPilot, in the operating system trust bundle and in the trust bundles included in Aviatrix container images. Solution

• Operating system trust bundle: Unattended upgrades should already have updated the operating system trust bundle on all CoPilots, Controllers running 8.0 or later, and Gateways running 8.1 or later, removing the eMudhra certificates. No action is required. For more information, see Unattended Upgrades
• Gateways running 8.0.x: These gateways do not receive unattended operating system updates. Image upgrade them to 8.1 or later to remove the eMudhra certificates.
• Container images: The next scheduled Aviatrix release will fully remove the eMudhra certificates from the system, including all container images. Upgrade to that release when it is available.

​

Multiple Vulnerabilities in Aviatrix Controllers

Date 06/26/2025 CVE # CVE-2025-2171 - Lack of password reset rate limiting exposes accounts to brute-force attacks.

• Risk Rating: CVSS 7.8 (High) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:P
• Description: Currently, there is no rate limiting or maximum attempts on a password reset. This means an attacker could request a reset token, and then brute force the token.

• Impact: A successful attack would allow the attacker to reset the password for any account, including the administrator account.

CVE # CVE-2025-2172 - Authenticated Remote Code Execution through Shell Parameter Injection (Administrator Privilege Required).

• Risk Rating: CVSS 6.6 (Medium) CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
• Description: A vulnerability could allow an authenticated admin user to execute arbitrary command against Aviatrix Controllers.
• Impact: A successful attack would allow arbitrary commands to be executed as root on the controller by an authenticated admin user.

Affected Products All supported versions of Aviatrix Controller prior to 8.0.0, 7.2.5090, 7.1.4208. These three releases were made available on May, 19 2025. Solution Upgrade the Controller to 8.0.0 or 7.2.5090 or 7.1.4208. Or, if running older versions install security patch CVE-2025-2171 and CVE-2025-2172 - Controller Security Vulnerabilities. Action to be taken if an upgrade is done to a release that does not have the fix in the release:

​

Applying a Security Patch

You can use either the Controller UI or CoPilot to apply the patch: Controller UI

1. Backup your Aviatrix Controller. For more information, see Controller Backup and Restore .
2. Navigate to Settings > Maintenance > Security Patches and click Update Available Patches followed by the refresh button.
3. Filter for CVE-2025-2171 and CVE-2025-2172 - Controller Security Vulnerabilities. If it is not presented in the table click the refresh button again.
4. Click CVE-2025-2171 and CVE-2025-2172 - Controller Security Vulnerabilities.
5. Click Actions.
6. Click Apply Patch.
7. Confirm that the patch shows Patched.
8. Backup your Aviatrix Controller again to save the new configuration.

CoPilot

1. Backup your Aviatrix Controller. For more information, see Back Up and Restore Your Controller on Controller UI .
2. Apply the security or software patch on the controller. From the Aviatrix Controller, navigate to Settings > Maintenance > SecurityPatches and click UpdateAvailablePatches. You should see the new patch in the display.
3. Apply the patch by clicking on the icon on the right and selecting Apply Patch from the popup menu.
4. Validate the update by clicking on the icon on the right and selecting Patch Status and scrolling down to bottom of page.
5. Backup your Aviatrix Controller again to save the new configuration.

Acknowledgment Aviatrix would like to thank Louis Dion-Marcil of Mandiant for the responsible disclosure of this vulnerability. The technical writeup can be found at Google Cloud Blog - Trix Shots: Remote Code Execution on Aviatrix Controller.

​

Remote Code Execution Vulnerability in Aviatrix Controllers

Date 01/07/2025 CVE # CVE-2024-50603 Risk Rating: CVSS 9.9 (Critical) for Aviatrix Controllers AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Description: A vulnerability could allow an unauthenticated user to execute arbitrary command against Aviatrix Controllers. Aviatrix has seen indications that bad actors are attempting to exploit this vulnerability, and strongly recommends that you take action to protect your controllers. Impact: A successful attack would allow arbitrary commands to be executed on the controller by an unauthenticated user. Affected Products: All supported versions of Aviatrix Controller prior to 7.2.4996 or 7.1.4191 Solution: Install security patch CVE-2024-50603 - Critical Vulnerability Security Patch or update the Controller to either 7.1.4191 or 7.2.4996. Additionally, Aviatrix recommends following the Controller IP Access guidance and ensuring that the controller does not have port 443 exposed to the Internet. To apply the patch, follow the standard procedure for Applying a Security Patch (see above section). Acknowledgment: Aviatrix would like to thank Louis Dion-Marcil of Mandiant for the responsible disclosure of this vulnerability. The technical writeup can be found at Google Cloud Blog - Trix Shots: Remote Code Execution on Aviatrix Controller.

​

Aviatrix Egress FQDN Firewall Security Misconfiguration

Date 04/02/2024 CVE # CVE-2023-52087 Risk Rating 5.5 (Medium) AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Description Aviatrix discovered a security issue related to the Aviatrix Egress FQDN Firewall. In prior releases, the firewall would ALLOW traffic on TLS ports for non-TLS traffic or for TLS traffic which did not have SNI headers. The current release will change the default behavior to DENY for non-TLS traffic. This is a breaking change from prior releases, so be sure to see the Solutions section of this advisory if this functionality must be preserved. Impact Packets that should be blocked by the Egress FQDN Firewall will be allowed through unexpectedly. Affected Products All versions before:

• 7.1.3006
• 7.0.2239
• 6.9.822
• 6.8.1826

Solution If you require allowing non-TLS traffic egress over HTTPS port, perform the following:

• Aviatrix Controller > Security > Egress Control > 3. Egress FQDN Filter > Global Config (CLICK).
• ENABLE “non-TLS traffic over HTTPS port” under Global Settings. For release 7.0.2239 and 7.1.3006 this can be done from the Controller UI. For release 6.9.822 or 6.8.1826 this cannot be done from the UI.
• If you choose to revert back to the old default behavior in release 6.9.822 or 6.8.1826, contact Aviatrix Support, who can help you toggle to ALLOW for this feature.

Since the non-TLS traffic using HTTPS port (tcp/443) is not logged in the syslog messages, there is no way to detect (in prior releases) this kind of traffic on the Aviatrix Controller/CoPilot UI.

​

Aviatrix Egress FQDN Firewall High-Availability Security Misconfiguration

Date 04/02/2024 CVE # CVE-2023-52087 Risk Rating 5.5 (Medium) AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Description If an Aviatrix Egress FQDN HA gateway is launched after an Egress FQDN tag is attached to the main gateway, then the HA gateway is launched in non-enforcing mode. The non-enforcing setting is clearly visible on the Controller UI. In this configuration, when the primary drops, the secondary will not enforce as expected. Impact The secondary Egress FQDN Firewall may come up in non-enforcing mode. This will potentially allow traffic through the Egress FQDN Firewall unexpectedly. Affected Products All versions before:

• 7.1.3006
• 7.0.2239
• 6.9.822
• 6.8.1826

Solution

• If you are running affected Aviatrix software releases and have existing HA Egress Firewall Gateways, temporarily remove the Egress FQDN Filter tag from the primary gateway and then re-add it.
• If you are running affected Aviatrix software releases and creating new HA Egress Firewall Gateways, create the HA gateway before assigning an Egress FQDN Filter tag.
• The latest Aviatrix software revisions have resolved this issue and no action is needed.

​

Remote Code Execution

Date 05/27/2022 Risk Rating AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0) Description Several vulnerabilities could be combined by an attacker to abuse a Gateway command mechanism that would allow arbitrary remote code execution. This vulnerability is not known to be exploited. Impact An unauthenticated attacker to run arbitrary commands against Aviatrix gateways. Affected Products Aviatrix Controller and Gateways. Solution: Upgrade your controller and gateway software to:

• 6.4.3057
• 6.5.3233
• 6.6.5612
• 6.7.1185

​

Post-Auth Remote Code Execution

Date 04/11/2022 Risk Rating High Description TLDAP APIs contain functions that are inappropriately sanitized, and would allow an authenticated malicious user to inject arbitrary commands. Impact A local user to the controller UI could execute arbitrary code. Affected Products Aviatrix Controller. Solution: Upgrade your controller and gateway software to:

• 6.4.3049
• 6.5.3166
• 6.6.5545

​

Aviatrix Controller and Gateways - Privilege Escalation

Date 02/03/2022 Risk Rating Medium Description The publicly disclosed CVE-2021-4034 and CVE-2022-0185 are local privilege escalation vulnerabilities disclosed in the past two weeks. When successfully executed, an attack exploiting these vulnerabilities can cause a local privilege escalation giving unprivileged users administrative rights on the target machine. The Aviatrix Gateway, Controller, and Copilot are all running vulnerable versions of the Linux packages. However, in order to successfully exploit these vulnerabilities, an attacker requires local access to Aviatrix systems, and no known vulnerability allows such an attack. Impact A local user on an Aviatrix appliance can escalate privileges to root. Affected Products Aviatrix Controller and Gateways. Solution

• Upgrade Copilot to Release 1.6.3.
• Apply security patch [AVI-2022-0001 - CVE-2021-4034 and CVE-2022-0185 Privilege Escalation Patches] to controllers.

​

Aviatrix Controller and Gateways - Unauthorized Access

Date 11 Nov 2022 Risk Rating High for Gateways, medium for Controller. Description On the Aviatrix Controller, a successful attack would allow an unauthenticated remote attacker partial access to configuration information and allow them to disrupt the service. On the gateway, a successful attack would allow an unauthenticated network-adjacent attacker (an attacker present on the gateway’s VPC) access to its API. Impact Access to configuration information and disruption of service. Affected Products Aviatrix Controller, Gateways and Copilot. Solution Upgrade your controller and gateway software to:

• 6.4.2995 or later.
• 6.5.2898 or later.