Intel

CVE-2020-3950

VMware Multiple Products — VMware Multiple Products Privilege Escalation Vulnerability

criticalKEV: actively exploitedPoCEPSS 7.2%

Description

VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.

Source: CISA_KEVNVDCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2020-3950 carries a CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and sits at the 93.9th EPSS percentile, indicating a very high likelihood of exploitation relative to the broader CVE population despite the local attack vector. The vulnerability requires only a standard user account and no user interaction, making it an effective second-stage payload after any form of initial access — phishing, credential theft, or a compromised remote session. For NIS2-scoped organisations with macOS endpoints in IT operations, DevOps, or OT-adjacent roles, root-level compromise of these systems poses a direct threat to confidentiality and integrity of managed infrastructure. CISA has not flagged known ransomware campaign use, but KEV inclusion confirms active exploitation in the wild — patch deployment should be completed within the next scheduled maintenance window and no later than 72 hours from detection of an unpatched asset.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply vendor patches immediately: Update VMware Fusion to 11.5.2 or later, VMware Remote Console for Mac to 11.0.1 or later, and Horizon Client for Mac to 5.4.0 or later (VMware Advisory VMSA-2020-0005).
  • Inventory affected endpoints: Query your MDM or run pkgutil --pkgs | grep -i vmware across macOS endpoints to identify all hosts running Fusion (11.x < 11.5.2), VMRC (11.x < 11.0.1), or Horizon Client (5.x < 5.4.0).
  • Prioritise high-value targets: Patch administrator, DevOps, and developer workstations first — these users typically have broader access, making post-exploitation impact significantly higher.
  • Restrict application launch until patched: If operational constraints delay patching, use MDM policy (e.g. Jamf Pro Restricted Software) to block execution of affected VMware applications on unpatched hosts.
  • Preserve forensic baseline: Collect Unified Log snapshots (log collect) and /var/log/system.log from affected hosts before applying patches to retain evidence for any post-incident investigation.

Runbook · Step 2

Mitigation layers

  • Strip setuid bits as a compensating control: If patching is delayed, manually remove the setuid bit from affected VMware binaries (chmod u-s <binary>). Validate with the operations team first — this will impair application functionality.
  • Enforce least-privilege on macOS endpoints: Ensure end users do not hold local administrator rights. Standard accounts without sudo access significantly raise the bar for exploitation, since the attacker already requires local access.
  • Activate EDR privilege-escalation detections: Ensure your EDR solution (e.g. CrowdStrike Falcon, SentinelOne) is current on all macOS hosts and that rules covering unexpected privilege escalation via setuid process chains are enabled.
  • Network segmentation: Isolate unpatched macOS hosts from management VLANs and internal infrastructure segments to limit lateral movement following a local compromise.
  • MDM software-version enforcement: Block installation of out-of-date VMware client versions via MDM policy and enforce automatic updates to prevent re-introduction of vulnerable versions.

Runbook · Step 3

Detection rules

  • macOS Unified Log — unexpected root-level VMware child processes: Monitor for processes with euid=0 spawned from VMware parent binaries. EDR process-ancestry alert: vmware-* → bash/sh/python with effective UID 0.
  • BSM / auditd — setuid execution events: Filter praudit output for AUE_SETUID and AUE_EXECVE events where the calling process matches a VMware binary and the effective UID transitions to 0.
  • Sigma rule shape (macOS EDR): 
    title: VMware setuid Privilege Escalation CVE-2020-3950
logsource: category=process_creation, product=macos
detection:
  selection:
    ParentImage|contains: 'vmware'
    IntegrityLevel: 'System'
  condition: selection
  • File integrity monitoring: Alert on unexpected modifications to /Applications/VMware Fusion.app, /Applications/VMware Horizon Client.app, and associated setuid binaries under /Library/ outside of approved patch windows.
  • Local privilege group changes: Monitor macOS system events for unexpected additions to the admin or wheel group, particularly when correlated with prior execution of a VMware process on the same host.

Metrics

Severity
critical
Priority score
195.66
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
7.8
Source: nvd-v3
CVSS v3
7.8
CVSS v4
—
EPSS percentile
94.0 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
7.2 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2021-11-03 00:00 UTC
CWE
—

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • vmware

    fusion11.0.0 – 11.5.2

  • vmware

    horizon_client5.0.0 – 5.4.0

  • vmware

    remote_console11.0.0 – 11.0.1

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2020-3950