3.9
Low
CVE-2023-20867 VMware Tools Authentication Bypass Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Weakness
CWE-287
Description
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| VMware Tools 12.2 | earliest → < 12.2.5 | 12.2.5 |
Other CVEs of VMware Tools
The 4 CVEs of VMware Tools →
CVE-2025-41244
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
7.8
High
CVE-2018-6969
VMware Tools (10.x and prior before 10.3.0) contains an out-of-bounds read vulnerability in HGFS
Not rated
CVE-2015-5191
VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths…
Not rated