VMware Tools Authentication Bypass Vulnerability (CVE-2023-20867)

What is affected, what to do

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

The vulnerability is being actively exploited; treat it as a priority. Update VMware Tools to version 12.2.5. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• VMware Tools lt 10.3.0..12.2.5
• Debian Linux eq 10.0..10.0
• Debian Linux eq 11.0..11.0
• Debian Linux eq 12.0..12.0
• Fedora eq 37..37
• Fedora eq 38..38
• Fedora eq 39..39

Fixed in

• VMware Tools 12.2.5

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade VMware Tools on all Windows guests to 12.2.5 or later. Per the context, 10.3.0 up to 12.2.5 is affected. Inventory the fleet via vCenter or PowerCLI: Get-VM | Select Name,@{N='Tools';E={$_.Guest.ToolsVersion}}.
   • Patch Linux guests (Debian 10/11/12, Fedora 37/38/39) through the distribution's open-vm-tools package. The patch is available from the vendor/distribution; look up the fixed package version in the respective DSA/DLA or Fedora update advisory.
   • Treat any ESXi host showing anomalies as compromised. Exploitation requires root on ESXi. In the short term:
     • Rotate root and other privileged host credentials.
     • Audit local ESXi accounts.
     • Disable SSH and the ESXi Shell (vim-cmd hostsvc/disable_ssh, vim-cmd hostsvc/disable_esx_shell).
   • Verify VIB integrity on every host. Run esxcli software vib list and esxcli software acceptance get. CommunitySupported or unknown-vendor VIBs indicate hypervisor-level persistence. If you find them, image the host for forensics and reinstall it rather than cleaning it.
   • Disable guest operations on critical VMs until they are patched. This covers domain controllers, PKI and backup servers. In the guest's tools.conf, add [guestoperations] with disabled = true underneath, then restart vmtoolsd.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation:
     • Restrict ESXi management (TCP 443, 902, 22) and vCenter to a dedicated admin VLAN or MFA-protected jump hosts.
     • Default-deny internet egress from the management network.
   • Hypervisor hardening:
     • Enable Lockdown Mode (normal or strict).
     • Set VMkernel.Boot.execInstalledOnly = TRUE and use UEFI Secure Boot so the host cannot run unsigned binaries or VIBs.
     • Enforce an acceptance level of at least PartnerSupported.
   • IAM/least privilege:
     • Stop the AD group "ESX Admins" from granting automatic admin rights on ESXi.
     • Use dedicated, non-domain break-glass accounts.
     • Limit the vCenter privilege "Virtual machine > Guest operations" to explicitly named service accounts.
   • Guest configuration: Beyond [guestoperations] disabled = true, disable unused Tools features. For example, set the VMX options isolation.tools.copy.disable = TRUE and isolation.tools.paste.disable = TRUE.
   • Logging: Forward ESXi syslog (hostd.log, shell.log, auth.log, vobd.log) off-host to the SIEM (esxcli system syslog config set --loghost=...). A compromised host can wipe its local logs.
3. 03

   Runbook step 3

   Detection rules

   • Guest EDR process ancestry (Windows): look for vmtoolsd.exe spawning shells or LOLBins. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "vmtoolsd.exe" and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe","certutil.exe"). The Sigma equivalent is Sysmon EID 1 with ParentImage|endswith: '\vmtoolsd.exe'.
   • Linux guests (auditd/EDR): look for execve events with parent vmtoolsd launching /bin/sh, /bin/bash, curl or wget. Collect with -a always,exit -F arch=b64 -S execve -k vmtools_exec and correlate on the ppid in the SIEM.
   • VGAuth logs in the guest: check C:\ProgramData\VMware\VMware VGAuth\logfile.txt.0 or /var/log/vmware-vgauthsvc.log.0. Guest operations that have no matching VGAuth authentication entry are high-fidelity suspicious.
   • ESXi hostd.log / vCenter events: watch for StartProgramInGuest, InitiateFileTransferToGuest and ListProcessesInGuest from users outside known automation accounts or outside maintenance windows. SPL: index=esxi sourcetype=hostd ("StartProgramInGuest" OR "InitiateFileTransferToGuest") | stats count by host,user,vm.
   • Hypervisor persistence: watch for new VIB installs in esxupdate.log/vobd.log, unexpected listeners (esxcli network ip connection list) and modifications to /etc/rc.local.d/local.sh.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

Source: Debian Security Advisories, pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Debian Debian Linux
• Debian Open-vm-tools
• Fedora Project Infrastructure Fedora
• VMware VMware Tools

Weakness classes (CWE)

• CWE-287Improper Authentication

  Class

  When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

  Entry at MITRE CWE-287

References & sources

• vmware.comVendor advisory: VMware ToolsPatch, Vendor advisory, pwn-watch
• security.netapp.comadvisory/ntap-20230725-0001Third-party advisory
• lists.debian.orgdebian-lts-announce/2023/08/msg00020.htmlMailing list, Third-party advisory
• debian.orgsecurity/2023/dsa-5493Mailing list, Third-party advisory
• lists.fedoraproject.orgarchives/list/package-announce@lists.fedoraproject.org/message/…Mailing list, Release notes
• lists.fedoraproject.orgarchives/list/package-announce@lists.fedoraproject.org/message/…Mailing list, Release notes
• lists.fedoraproject.orgarchives/list/package-announce@lists.fedoraproject.org/message/…Mailing list, Release notes
• openwall.comlists/oss-security/2023/10/16/2Mailing list, Patch
• openwall.comlists/oss-security/2023/10/16/11Mailing list, Patch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20867government-resource, US government resource
• pwn.watchpwn.watch: VMware Tools: Authentication Bypass (CVE-2023-20867)pwn-watch
• NVD (NIST)NVD: CVE-2023-20867pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch