Tools
Vendor:
First CVE: Aug 28, 2014 · Active for 11 years
22
Total CVEs
More Total CVEs than 94% of tracked products
2.2
Avg CVEs / Year
Higher CVE frequency than 73% of tracked products
6.6
Avg CVSS
Higher Avg CVSS than 33% of tracked products
9.1%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Tools over time
Volume of CVEsAvg CVSS Base Score
First CVE
Aug 28, 2014
11 years ago
Most Recent CVE
Sep 29, 2025
298 days ago
CVE Severity & Scoring
Tools22 CVEs
9%
32%
59%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local18 (81.8%)
Network0 (0.0%)
Unknown2 (9.1%)
Physical0 (0.0%)
Adjacent Network2 (9.1%)
Attack Complexity
Low14 (63.6%)
High6 (27.3%)
Unknown2 (9.1%)
User Interaction
None18 (81.8%)
Unknown2 (9.1%)
Required2 (9.1%)
Privileges Required
Low15 (68.2%)
High2 (9.1%)
None3 (13.6%)
Unknown2 (9.1%)
Top CVEs
Signals from CVEs in this product scope (22 CVEs).
22 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-41244HIGH VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VM | Sep 29, 2025 | 7.8 | 73 | YES | NO |
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. | Jun 13, 2023 | 3.9 | 60 | YES | NO |
CVE-2016-5330HIGH Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware Tools 10.0.5 in VMware ESXi 5.0 through 6.0, VMware Workstation Pro 12.1.x before 12.1.1, VMw | Aug 8, 2016 | 7.8 | 55 | NO | YES |
CVE-2022-31676HIGH VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate pr | Aug 23, 2022 | 7.8 | 28 | NO | NO |
CVE-2023-34058HIGH VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0 | Oct 27, 2023 | 7.5 | 25 | NO | NO |
CVE-2023-34057HIGH VMware Tools contains a local privilege escalation vulnerability. A malicious actor with local user access to a guest virtual machine may elevate privileges within the virtual mach | Oct 27, 2023 | 7.8 | 25 | NO | NO |
CVE-2023-20900HIGH A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html i | Aug 31, 2023 | 7.5 | 25 | NO | NO |
CVE-2022-22977HIGH VMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains an XML External Entity (XXE) vulnerability. A malicious actor with non-administrative local user privileges in the Wind | May 24, 2022 | 7.1 | 25 | NO | NO |
CVE-2021-21999HIGH VMware Tools for Windows (11.x.y prior to 11.2.6), VMware Remote Console for Windows (12.x prior to 12.0.1) , VMware App Volumes (2.x prior to 2.18.10 and 4 prior to 2103) contain | Jun 23, 2021 | 7.8 | 25 | NO | NO |
CVE-2016-7080HIGH The graphic acceleration functions in VMware Tools 9.x and 10.x before 10.0.9 on OS X allow local users to gain privileges or cause a denial of service (NULL pointer dereference) v | Dec 29, 2016 | 7.8 | 25 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (22 CVEs).
CISA KEV
2 CVEs
9.1% of CVEs· 97th percentile
Metasploit
1 CVE
4.5% of CVEs· 96th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
4.5% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (22 CVEs).
Media Mentions
Signals from CVEs in this product scope (22 CVEs).
Top CNAs Publishing CVEs For Tools
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 9.4.5 | 3 | 7.0 | 0.4% | 0 | 0 |
| 9.4.15 | 3 | 7.0 | 0.4% | 0 | 0 |
| 9.4.12 | 3 | 7.0 | 0.4% | 0 | 0 |
| 9.4.11 | 3 | 7.0 | 0.4% | 0 | 0 |
| 9.4.10 | 3 | 7.0 | 0.4% | 0 | 0 |
| 9.4.0 | 3 | 7.0 | 0.4% | 0 | 0 |
| 9.10.5 | 3 | 7.0 | 0.4% | 0 | 0 |
| 9.10.1 | 3 | 7.0 | 0.4% | 0 | 0 |
| 9.10.0 | 3 | 7.0 | 0.4% | 0 | 0 |
| 9.0.5 | 3 | 7.0 | 0.4% | 0 | 0 |
| 9.0.17 | 3 | 7.0 | 0.4% | 0 | 0 |
| 9.0.16 | 3 | 7.0 | 0.4% | 0 | 0 |
| 9.0.15 | 3 | 7.0 | 0.4% | 0 | 0 |
| 9.0.13 | 3 | 7.0 | 0.4% | 0 | 0 |
| 9.0.12 | 3 | 7.0 | 0.4% | 0 | 0 |
| 9.0.11 | 3 | 7.0 | 0.4% | 0 | 0 |
| 9.0.10 | 3 | 7.0 | 0.4% | 0 | 0 |
| 9.0.1 | 3 | 7.0 | 0.4% | 0 | 0 |
| 9.0.0 | 3 | 7.0 | 0.4% | 0 | 0 |
| 10.0.6 | 3 | 7.0 | 0.4% | 0 | 0 |