CVE-2023-20867: VMware Tools Authentication Bypass Vulnerability
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.
Published Jun 13, 2023 · Updated Jun 17, 2026
Required action
Apply updates per vendor instructions.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.
References
- https://lists.debian.org/debian-lts-announce/2023/08/msg00020.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/
- https://security.netapp.com/advisory/ntap-20230725-0001/
- https://www.debian.org/security/2023/dsa-5493
- https://www.vmware.com/security/advisories/VMSA-2023-0013.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20867
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More VMware vulnerabilities
All VMware entriesCVE-2025-22224
VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
high8.2ExploitedMar 4, 2025CVE-2025-22225
VMware ESXi Arbitrary Write Vulnerability
high8.2ExploitedMar 4, 2025CVE-2025-22226
VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
medium6.0ExploitedMar 4, 2025CVE-2024-38812
VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
critical9.8ExploitedSep 17, 2024CVE-2024-38813
VMware vCenter Server Privilege Escalation Vulnerability
critical9.8ExploitedSep 17, 2024CVE-2024-37085
VMware ESXi Authentication Bypass Vulnerability
high7.2ExploitedJun 25, 2024