VMware Open Vm Tools vulnerabilities

5 CVEs affecting VMware Open Vm Tools, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-41244, published 2025-09-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-41244: Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability, published 2025-09-29. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2025-10-30. EPSS: 8.4% chance of exploitation in the next 30 days. VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware…
CVE-2023-20900, published 2023-08-31. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual…
CVE-2023-34058, published 2023-10-27. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges…
CVE-2023-34059, published 2023-10-27. High severity, CVSS 7.0. EPSS: 0.4% chance of exploitation in the next 30 days. open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack the /dev/uinput file descriptor…
CVE-2009-1142, published 2022-11-23. Medium severity, CVSS 6.7. EPSS: 0.3% chance of exploitation in the next 30 days. An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can gain privileges via a symlink attack on /tmp files if vmware-user-suid-wrapper is setuid root and the ChmodChownDirectory…