{"id":"CVE-2020-3950","kind":"vulnerability","aliases":["CVE-2020-3950"],"related":[],"title":"VMware Multiple Products: VMware Multiple Products Privilege Escalation Vulnerability","description":"VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.","summary":"VMware Fusion, Remote Console for Mac, and Horizon Client for Mac contain a privilege escalation flaw caused by improper use of setuid binaries. A local user with normal privileges can gain root on the affected Mac.","severity":"high","cvss":7.8,"epss":0.07254,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"VMware Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","horizon-client","macos","vendor","vmrc","vmware-fusion"],"not_affected_if":["fixed-version-installed","product-not-installed"],"how_to_check":"Open VMware Fusion, VMRC, or Horizon Client and check the version under About; compare against Fusion 11.5.2+, VMRC 11.0.1+, Horizon Client 5.4.0+.","fix":"Update VMware Fusion to 11.5.2 or later, VMware Remote Console for Mac to 11.0.1 or later, and Horizon Client for Mac to 5.4.0 or later.","status":"open","published_at":"2020-03-17T19:15:12+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T20:29:41+00:00","updated_at":"2026-10-23T20:29:41+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T20:29:41Z","model":"claude-haiku-5-5","output":{"fix":"Update VMware Fusion to 11.5.2 or later, VMware Remote Console for Mac to 11.0.1 or later, and Horizon Client for Mac to 5.4.0 or later.","summary":"VMware Fusion, Remote Console for Mac, and Horizon Client for Mac contain a privilege escalation flaw caused by improper use of setuid binaries. A local user with normal privileges can gain root on the affected Mac.","category":"vendor","who_cares":["vmware-fusion","macos","horizon-client","vmrc"],"confidence":0.8,"analyst_note":"Confirm the exact fixed builds and check the VMware advisory (VMSA-2020-0023) and the CISA KEV entry; the sources give no per-product check command.","how_to_check":"Open VMware Fusion, VMRC, or Horizon Client and check the version under About; compare against Fusion 11.5.2+, VMRC 11.0.1+, Horizon Client 5.4.0+.\nunknown","needs_analyst":true,"not_affected_if":["fixed-version-installed","product-not-installed"],"severity_if_unknown":"high"},"cost_usd":0.000416,"input_tokens":2185,"output_tokens":395,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2020':11A,14A '-3950':12A,15A '11':67C,76C '11.0.1':81C '11.5.2':70C '5':87C '5.4.0':92C 'affect':63B 'allow':111C 'attack':112C 'binari':51B,104C 'caus':45B 'client':22B,37B,84C,131C 'consol':32B,73C 'contain':40B,93C 'cve':10A,13A 'due':98C 'escal':8A,43B,96C,118C 'exploit':19B,106C 'flaw':44B 'fusion':28B,30B,66C,127C 'gain':59B 'horizon':21B,36B,83C,130C 'horizon-cli':20B 'improp':47B,100C 'instal':133C 'issu':109C 'local':53B 'mac':34B,39B,64B,75C,86C 'maco':23B 'may':110C 'multipl':2A,5A 'multiple':17A 'normal':56B,114C 'prior':79C,90C 'privileg':7A,42B,57B,95C,116C,120C 'product':3A,6A 'products':18A 'remot':31B,72C 'root':60B,122C 'setuid':50B,103C 'success':105C 'system':125C 'use':48B,101C 'user':54B,115C 'vendor':24B 'vmrc':25B,128C 'vmware':1A,4A,16A,27B,29B,65C,71C 'vmware-fus':26B 'vulner':9A,97C 'x':68C,77C,88C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-03-17T19:15:12+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-3950","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-3950","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T11:39:18+00:00","note":null},{"source":"epss","external_id":"CVE-2020-3950","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-3950","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-3950","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-3950","severity":null,"published_at":"2020-03-17T19:15:12+00:00","modified_at":"2026-06-17T03:19:18+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}