{"id":"CVE-2023-20867","kind":"vulnerability","aliases":["CVE-2023-20867"],"related":[],"title":"A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the…","description":"VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.\n\nCISA required action: Apply updates per vendor instructions.","summary":"VMware Tools has an authentication bypass in its vgauth module that lets host-to-guest operations skip authentication. An attacker who has fully compromised the ESXi host can read or change data inside the guest virtual machine.","severity":"high","cvss":3.9,"epss":null,"exploited":true,"exploited_at":"2023-06-23T00:00:00+00:00","products":[{"name":"vmware tools","fixed":["12.2.5"],"affected":">= 10.3.0, < 12.2.5","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 12.0","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 37","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 38","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 39","ecosystem":"vendor"},{"name":"VMware Tools","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["esxi","exploited","infrastructure","virtual-machines","vmware-tools","vsphere"],"not_affected_if":["no-esxi-host-compromise","vmware-tools-not-installed"],"how_to_check":null,"fix":"Apply the VMware Tools update per vendor instructions; the fixed version is unknown from the sources.","status":"open","published_at":"2023-06-13T17:15:14+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:06:30+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:06:30Z","model":"claude-haiku-5-5","output":{"fix":"Apply the VMware Tools update per vendor instructions; the fixed version is unknown from the sources.","reach":"local","impact":"high","summary":"VMware Tools has an authentication bypass in its vgauth module that lets host-to-guest operations skip authentication. An attacker who has fully compromised the ESXi host can read or change data inside the guest virtual machine.","category":"infrastructure","who_cares":["vmware-tools","esxi","vsphere","virtual-machines"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker with ESXi root reads and alters guest VM data.","analyst_note":"Find the fixed VMware Tools and ESXi versions and the VMSA advisory for CVE-2023-20867 on the Broadcom/VMware security advisories page; sources here do not list affected versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-esxi-host-compromise","vmware-tools-not-installed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000475,"input_tokens":2843,"output_tokens":381,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':21A,24A '-20867':22A,25A 'access':134C 'action':143C 'appli':144C 'attack':72B,130C 'authent':13A,56B,70B,94C,113C 'bypass':57B,95C 'chang':83B 'cisa':141C 'compromis':3A,76B,103C 'confidenti':121C 'contain':92C 'cve':20A,23A 'data':84B 'debian':28A,30A,32A 'esxi':4A,42B,78B,104C,136C 'exploit':43B,138C 'fail':11A,111C 'fedora':35A,37A,39A 'fedoraproject':34A,36A,38A 'forc':7A,107C 'fulli':2A,75B,102C 'guest':17A,67B,87B,117C,126C 'host':5A,15A,65B,79B,105C,115C 'host-to-guest':14A,64B,114C 'impact':19A,119C 'infrastructur':44B 'insid':85B 'instruct':148C 'integr':123C 'let':63B 'linux':29A,31A,33A 'machin':47B,89B,128C 'modul':61B,100C 'must':131C 'oper':18A,68B,118C 'per':146C 'read':81B 'requir':142C 'root':133C 'skip':69B 'tool':9A,50B,53B,91C,109C 'tools':27A,41A 'updat':145C 'vendor':147C 'vgauth':60B,99C 'virtual':46B,88B,127C 'virtual-machin':45B 'vmware':8A,26A,40A,49B,52B,90C,108C 'vmware-tool':48B 'vsphere':51B 'vulner':96C,140C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-06-13T17:15:14+00:00","kev":{"dateAdded":"2023-06-23","dueDate":"2023-07-14","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@vmware.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-20867","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20867","severity":null,"published_at":"2023-06-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:23+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-20867","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20867","severity":null,"published_at":"2023-06-13T17:15:14+00:00","modified_at":"2026-06-17T05:31:03+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}