CVE-2023-20867: low-severity vulnerability in VMware Tools
VMware Tools Authentication Bypass Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and 1 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
A compromised ESXi host can bypass authentication checks in VMware Tools, allowing unauthorized access to guest virtual machines and potentially exposing or modifying their data.
CVE-2023-20867 is an authentication bypass in VMware Tools triggered when the ESXi host is fully compromised. The attack vector requires prior host-level compromise to force Tools authentication failure for host-to-guest operations, affecting guest VM confidentiality and integrity.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.