ZeroDay Findings
Sign inSign up

Findings

CVE-2023-20867

VMware Tools Authentication Bypass Vulnerability

Published Jun 13, 2023 · updated Jun 16, 2026 · vmware tools

VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 13, 2023 · Catalog

    Detected

    VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.

  2. Jun 23, 2023 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jul 14, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.

Required action

Apply updates per vendor instructions.

CISA due date Jul 14, 2023

Affected

  • cpe debian/debian linux10.0
  • cpe debian/debian linux11.0
  • cpe debian/debian linux12.0
  • cpe fedoraproject/fedora37
  • cpe fedoraproject/fedora38
  • cpe fedoraproject/fedora39
  • cpe vmware/toolsversion unspecified
  • vendor VMware Toolsversion unspecified

Sources

  • CISA KEVCVE-2023-20867

    VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.

    cisa.gov
  • CVE.orgCVE-2023-20867

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-20867

    30-day exploitation probability 13.5%

    first.org
  • NIST NVDCVE-2023-20867

    A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

    nvd.nist.gov

References