Skip to content

Product

VMware Tools vulnerabilities

4 published CVES affecting VMware Tools, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
0
High
2
Medium
1
Low
1
Unscored
0
CISA KEV
2

Latest VMware Tools CVEs

Newest publication first

  1. CVE-2025-41244 VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)

    Published
    HighCVSS 7.8 EPSS 16.4% CISA KEV added 2025-10-30 Exploited in the wild

    VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability...

  2. CVE-2023-20867 VMware Tools Authentication Bypass Vulnerability

    Published
    LowCVSS 3.9 EPSS 13.6% CISA KEV added 2023-06-23 Exploited in the wild

    A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

  3. CVE-2018-6969 VMware Tools (10.x and prior before 10.3.0) contains an out-of-bounds read vulnerability in HGFS. Successful exploitation of this issue may lead to information disclosure or may allow attackers to esc...

    Published
    HighCVSS 7.0 EPSS 0.40%

    VMware Tools (10.x and prior before 10.3.0) contains an out-of-bounds read vulnerability in HGFS. Successful exploitation of this issue may lead to information disclosure or may allow attackers to escalate their privileges on the guest VMs. In order to be able to exploit this iss...

  4. CVE-2015-5191 VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privile...

    Published
    MediumCVSS 6.7 EPSS 0.33%

    VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.