CVE-2023-20867
VMware Tools Authentication Bypass Vulnerability
VMware Tools Authentication Bypass Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply updates per vendor instructions.
CISA notes
https://www.vmware.com/security/advisories/VMSA-2023-0013.html; https://nvd.nist.gov/vuln/detail/CVE-2023-20867
Description
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.
Severity
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:NExploitation Context
as of October 15, 2026- CISA added CVE-2023-20867 to the KEV catalog 10 days after its CVE record was published. The median for entries added in 2023 is 12 days.
- It is one of 33 VMware entries in the CISA KEV catalog, and one of 2 added in 2023.
- Its current EPSS score (13.5%) is higher than that of 29% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| VMware | VMware VMware Tools | 12.2.5 (unaffected) |
References
9 Links- https://www.vmware.com/security/advisories/VMSA-2023-0013.html
- https://security.netapp.com/advisory/ntap-20230725-0001/
- https://lists.debian.org/debian-lts-announce/2023/08/msg00020.html
- https://www.debian.org/security/2023/dsa-5493
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/
- http://www.openwall.com/lists/oss-security/2023/10/16/2
- http://www.openwall.com/lists/oss-security/2023/10/16/11
Record Details
More from VMware
VMware vCenter Server Improper Input Validation Vulnerability
VMware vCenter Server File Upload Vulnerability
VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
Related
Tool categories
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.