CVE-2023-20867

KEVVMware Tools Authentication Bypass Vulnerability

Description

VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

CVSS 3.1 vectorCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

PublishedJun 13, 2023

Last modifiedJun 17, 2026

Added to KEVJun 23, 2023

Remediation dueJul 14, 2023

References

openwall.com/lists/oss-security/2023/10/16/11Mailing ListPatch
openwall.com/lists/oss-security/2023/10/16/2Mailing ListPatch
lists.debian.org/debian-lts-announce/2023/08/msg00020.htmlMailing ListThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/Mailing ListRelease Notes
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/Mailing ListRelease Notes
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/Mailing ListRelease Notes
security.netapp.com/advisory/ntap-20230725-0001/Third Party Advisory
debian.org/security/2023/dsa-5493Mailing ListThird Party Advisory
vmware.com/security/advisories/VMSA-2023-0013.htmlPatchVendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20867US Government Resource

0 recent articles mention this CVE

Risk assessment · Medium

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1200 days
CVSS: 3.9 LOW
EPSS (30-day exploit probability): 13.6% · top 4% of all CVEs
Weakness: CWE-287

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.