Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-20867

60
FAUCET Score

CVE-2023-20867 is a vulnerability in VMware Tools affecting various Linux distributions, where a fully compromised ESXi host can bypass authentication for host-to-guest operations. This low-severity flaw (CVSS 3.9) has a high attack complexity and requires high privileges on the ESXi host, but can impact the confidentiality and integrity of guest virtual machines. Notably, this vulnerability is actively exploited in the wild, with Mandiant reporting exploitation by UNC3886 since 2021, and it has garnered significant community discussion and media coverage despite no public exploit code being available.

Impacted Technologies

VendorProductVersion(s)CPE
>= 10.3.0, < 12.2.5CPE matchmatch criteria
cpe:2.3:a:vmware:tools:*:*:*:*:*:*:*:*
10.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
11.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
12.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
37CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

3.9LOW

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
Exploitability Score
0.8
Impact Score
2.7
CvssVersion
3.1

Exploit Intelligence

EPSS Score
13.53%
Probability of exploitation in next 30 days
EPSS Percentile
96.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
Added to KEV · Jun 23, 2023
This CVE's current EPSS score of 0.1353 is in the 100th percentile among its peer group of 67 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.5 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (12)

redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.0 Extended Update SupportFixed in: open-vm-tools-0:11.3.5-1.el9_0.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: open-vm-tools-0:11.0.5-3.el7_9.6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: open-vm-tools-0:12.1.5-2.el8_8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: open-vm-tools-0:11.0.0-4.el8_2.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Telecommunications Update ServiceFixed in: open-vm-tools-0:11.0.0-4.el8_2.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Update Services for SAP SolutionsFixed in: open-vm-tools-0:11.0.0-4.el8_2.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: open-vm-tools-0:11.2.0-2.el8_4.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceFixed in: open-vm-tools-0:11.2.0-2.el8_4.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsFixed in: open-vm-tools-0:11.2.0-2.el8_4.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: open-vm-tools-0:11.3.5-1.el8_6.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: open-vm-tools-0:12.1.5-1.el9_2.1
View patch
vmwarepatch availablevia nvd_reference
View patch

Vendor Advisories (1)

redhatCVE-2023-20867Low

open-vm-tools: authentication bypass vulnerability in the vgauth module

Jun 13, 2023

References

cisa.gov / known-exploited-vulnerabilities-catalog
US Government Resource
lists.debian.org / debian-lts-announce/2023/08/msg00020.html
Mailing ListThird Party Advisory
lists.fedoraproject.org / archives/list/[email protected]/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG
Mailing ListRelease Notes
lists.fedoraproject.org / archives/list/[email protected]/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W
Mailing ListRelease Notes
lists.fedoraproject.org / archives/list/[email protected]/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH
Mailing ListRelease Notes
security.netapp.com / advisory/ntap-20230725-0001
Third Party Advisory
debian.org / security/2023/dsa-5493
Mailing ListThird Party Advisory
vmware.com / security/advisories/VMSA-2023-0013.html
PatchVendor Advisory
openwall.com / lists/oss-security/2023/10/16/11
Mailing ListPatch
openwall.com / lists/oss-security/2023/10/16/2
Mailing ListPatch