VMware Tools vulnerabilities

24 CVEs affecting VMware Tools, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-41244, published 2025-09-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-20867: VMware Tools Authentication Bypass Vulnerability, published 2023-06-13. Low severity, CVSS 3.9. Actively exploited: in CISA KEV since 2023-06-23. EPSS: 13.5% chance of exploitation in the next 30 days. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.
CVE-2025-41244: Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability, published 2025-09-29. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2025-10-30. EPSS: 8.4% chance of exploitation in the next 30 days. VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware…
CVE-2016-5330, published 2016-08-08. High severity, CVSS 7.8. EPSS: 18% chance of exploitation in the next 30 days. Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware Tools 10.0.5 in VMware ESXi 5.0 through 6.0, VMware Workstation Pro 12.1.x before 12.1.1, VMware Workstation…
CVE-2025-41239, published 2025-07-15. High severity, CVSS 7.1. EPSS: 3.2% chance of exploitation in the next 30 days. VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. A malicious actor with local…
CVE-2021-21999, published 2021-06-23. High severity, CVSS 7.8. EPSS: 1.5% chance of exploitation in the next 30 days. VMware Tools for Windows (11.x.y prior to 11.2.6), VMware Remote Console for Windows (12.x prior to 12.0.1) , VMware App Volumes (2.x prior to 2.18.10 and 4 prior to 2103) contain a local privilege…
CVE-2023-20900, published 2023-08-31. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual…
CVE-2022-22943, published 2022-03-03. Medium severity, CVSS 6.7. EPSS: 1.2% chance of exploitation in the next 30 days. VMware Tools for Windows (11.x.y and 10.x.y prior to 12.0.0) contains an uncontrolled search path vulnerability. A malicious actor with local administrative privileges in the Windows guest OS, where…
CVE-2022-22977, published 2022-05-24. High severity, CVSS 7.1. EPSS: 0.8% chance of exploitation in the next 30 days. VMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains an XML External Entity (XXE) vulnerability. A malicious actor with non-administrative local user privileges in the Windows guest OS, where…
CVE-2023-34058, published 2023-10-27. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges…
CVE-2021-21997, published 2021-06-18. Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days. VMware Tools for Windows (11.x.y prior to 11.3.0) contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with local user privileges in the Windows guest operating system,…

Latest

CVE-2025-41246, published 2025-09-29. High severity, CVSS 7.6. EPSS: 0.3% chance of exploitation in the next 30 days. VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls. A malicious actor with non-administrative privileges on a guest VM, who is…
CVE-2023-34057, published 2023-10-27. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. VMware Tools contains a local privilege escalation vulnerability. A malicious actor with local user access to a guest virtual machine may elevate privileges within the virtual machine.
CVE-2022-31693, published 2023-06-07. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. VMware Tools for Windows (12.x.y prior to 12.1.5, 11.x.y and 10.x.y) contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with local user privileges in the Windows guest…
CVE-2022-31676, published 2022-08-23. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root…