Threats / VMware / CVE-2023-20867
CVE-2023-20867
· EUVD no mirror located
· GCVE no mirror located
Verified 2026-06-22
VMware Tools vulnerability
VMware Tools vgauth module contains an authentication bypass vulnerability allowing attackers with root access on ESXi hosts to compromise guest virtual machine integrity and confidentiality.
Verdict
Today item — known-exploited.
An attacker with ESXi root privileges can bypass host-to-guest authentication in VMware Tools, enabling unauthorized access to guest operations. This vulnerability has been exploited in the wild and requires elevated host-level access.
01
Is it exploitable?
— the evidence, ranked above the scoreReported exploitation
17 independent public reports of in-the-wild exploitation are cataloged.Distinct reporting sources (vendor, incident response, government); open them for the underlying claims.
Exploited in the wild
Listed in the CISA Known Exploited Vulnerabilities catalog (added 2023-06-23).
Probability (EPSS)
EPSS 0.13638 — modeled likelihood of exploitation activity.EPSS is a daily-changing model output — open the source for today's value.
Severity / affected
Affected: VMware, Tools. Confirm exact fixed builds in the vendor advisory.
Weakness (CWE)
Mapped to CWE-287 Improper Authentication — weakness family: Authentication.CWE assignment from the public NVD record; the weakness class drives how the flaw is exploited.
02
Who’s exploiting it?
— attribution turns risk into urgencyAttribution not established
No confirmed (advisory-backed) threat-actor attribution is established for this record. Absence of a named actor is not absence of compromise — see Coverage & confidence.
03
Why it matters
— the attack path, told twice: adversary, then board1
Front door — unauthenticated access narrative 1
Attacker
I gain root access to an ESXi hypervisor through a separate compromise or misconfiguration.
Business
The organization's hypervisor security perimeter is breached, creating a pivot point to all hosted virtual machines.
2
Keys to the kingdom — privilege/identity takeover narrative 2
Attacker
I exploit the vgauth authentication bypass to force VMware Tools to fail authentication checks between the host and guest.
Business
Guest virtual machines lose trust boundaries with their host, enabling lateral movement and data exfiltration.
3
Lateral reach — past segmentation narrative 3
Attacker
I perform unauthorized host-to-guest operations on compromised virtual machines without proper authentication.
Business
Sensitive data within guest systems is exposed and guest system integrity is compromised across the infrastructure.
04
What to do
— defensible action- Remediate per the vendor advisory — confirm the fixed build for your version and verify exposure.1
Say it to the boardA vulnerability with this evidence profile is a defensible budget line, not a backlog ticket — fund the change against the proof above.
05