CVE-2023-20867: VMware Tools Authentication Bypass Vulnerability

Low severity, CVSS 3.9. Actively exploited: in CISA KEV since 2023-06-23. EPSS: 13.5% chance of exploitation in the next 30 days.

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only; version 12.0 only
• Fedoraproject Fedora: version 37 only; version 38 only; version 39 only
• VMware Tools: from 10.3.0, before 12.2.5 (fixed in 12.2.5)

Published 2023-06-13. Last modified 2026-06-17.