CVE-2023-20867: VMware Tools authentication bypass from compromised ESXi host

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

medium priorityIt is in CISA KEV with a high EPSS percentile, but exploitation requires a fully compromised ESXi host and the CVSS base score is only 3.9.

What it is

VMware Tools can be forced by a fully compromised ESXi host to fail authentication of host-to-guest operations. This lets a host-level attacker tamper with the guest VM's confidentiality and integrity, though the flaw only matters after the hypervisor is already owned.

Impact

An attacker who already controls the ESXi host can bypass VMware Tools authentication and read or alter guest VM data, weakening the isolation boundary between host and guest.

Attack surface

Reached locally from a compromised ESXi host to the guest via VMware Tools host-to-guest operations; the CVSS vector requires high privileges and high attack complexity, with no user interaction.

Exploitation

Listed in CISA KEV with a 2023-07-14 remediation due date and an EPSS 30-day probability of about 13.5 percent (96th percentile), but no known ransomware use and no public exploit tag in the references.

What to do

• Apply the VMware patch per VMSA-2023-0013 and update VMware Tools in affected guests.
• Apply the Debian DSA-5493 and Fedora package updates for open-vm-tools.
• Treat ESXi host compromise as a guest-integrity incident and re-verify guest data after host compromise.
• Restrict and monitor ESXi management access to reduce the chance a host is fully compromised.
• Track KEV remediation deadlines and confirm all affected guests are updated.

Detection

• Alert on unexpected VMware Tools host-to-guest operation failures or authentication errors in guest logs.
• Monitor ESXi management access and privilege changes for signs of full host compromise.
• Audit guest file and configuration integrity for unexplained changes after any ESXi host incident.
• Inventory VMware Tools and open-vm-tools versions to find unpatched guests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.