{"id":"CVE-2023-20867","published":"2023-06-13T17:15:14Z","modified":"2026-06-17T05:31:03Z","title":"VMware Tools Authentication Bypass Vulnerability","vendor":"VMware","product":"Tools","tier":"core","eol":null,"description":{"text":"A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an authentication bypass in VMware Tools, where a fully compromised ESXi host can cause Tools to fail to authenticate host-to-guest operations. An attacker who already has full control of the ESXi host, with high privileges required and local access, can impact the confidentiality and integrity of the guest virtual machine.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:16Z"},"cvss":{"score":3.9,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.13638,"percentile":0.96472,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-06-23","dueDate":"2023-07-14","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.vmware.com/security/advisories/VMSA-2023-0013.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-20867","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-06-13","exploitedFirstSeen":"2023-06-13","ransomware":true,"evidence":[{"url":"https://www.mandiant.com/resources/blog/vmware-esxi-zero-day-bypass","date":"2023-06-13"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-06-23"},{"url":"https://www.mandiant.com/resources/blog/chinese-espionage-tactics","date":"2023-07-18"},{"url":"https://information.rapid7.com/rs/411-NAK-970/images/Rapid7-2023-Mid-Year-Threat-Review.pdf","date":"2023-08-17"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2023-1107.pdf","date":"2023-11-07"},{"url":"https://www.mandiant.com/resources/blog/chinese-vmware-exploitation-since-2021","date":"2024-01-18"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/2023-zero-day-trends","date":"2024-03-27"},{"url":"https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Year_in_Review_of_ZeroDays.pdf","date":"2024-03-27"},{"url":"https://www.rapid7.com/globalassets/_pdfs/research/rapid7_2024_attack_intelligence_report.pdf","date":"2024-05-21"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations","date":"2024-06-18"}],"evidenceTotal":18,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2023/10/16/11","tags":["Mailing List","Patch"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/16/2","tags":["Mailing List","Patch"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00020.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/","tags":["Mailing List","Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/","tags":["Mailing List","Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/","tags":["Mailing List","Release Notes"]},{"url":"https://security.netapp.com/advisory/ntap-20230725-0001/","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5493","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.vmware.com/security/advisories/VMSA-2023-0013.html","tags":["Patch","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/16/11","tags":["Mailing List","Patch"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/16/2","tags":["Mailing List","Patch"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00020.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/","tags":["Mailing List","Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/","tags":["Mailing List","Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/","tags":["Mailing List","Release Notes"]},{"url":"https://security.netapp.com/advisory/ntap-20230725-0001/","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5493","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.vmware.com/security/advisories/VMSA-2023-0013.html","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20867","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by an adversary who has fully compromised ESXi host. The adversary can exploit the authentication bypass flaw, leading to a failure in authenticating host-to-guest operations. The threat group UNC3886 has exploited this vulnerability to deploy VirtualPita and VirtualPie backdoors on guest VMs by escalating privileges to root on compromised ESXi hosts. This allows for unauthenticated command execution and file transfer.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited by an adversary who has fully compromised ESXi host. The adversary can exploit the authentication bypass flaw, leading to a failure in authenticating host-to-guest operations. The threat group UNC3886 has exploited this vulnerability to deploy VirtualPita and VirtualPie backdoors on guest VMs by escalating privileges to root on compromised ESXi hosts. This allows for unauthenticated command execution and file transfer.","confidence":"high"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited by an adversary who has fully compromised ESXi host. The adversary can exploit the authentication bypass flaw, leading to a failure in authenticating host-to-guest operations. The threat group UNC3886 has exploited this vulnerability to deploy VirtualPita and VirtualPie backdoors on guest VMs by escalating privileges to root on compromised ESXi hosts. This allows for unauthenticated command execution and file transfer.","confidence":"high"}],"reports":[{"id":"SRC-d520834e84b63932946c","title":"Cloaked and Covert: Uncovering UNC3886 Espionage Operations","publisher":"cloud.google.com","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations","date":null,"mentions":[{"quote":"CVE-2023-20867 in VMware Tools was exploited to execute unauthenticated Guest Operations from ESXi host to guest virtual machines.","start":3513,"end":3643},{"quote":"After gaining access to the guest virtual machines, either through the collection of vpxuser credentials or by exploiting CVE-2023-20867 in conjunction with VMware Guest Operations abuse to facilitate malicious file transfer and execution, UNC3886 was observed deploying backdoored SSH clients and daemons.","start":18640,"end":18946}]},{"id":"SRC-348e3b6201160b38a1f1","title":"VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors","publisher":"cloud.google.com","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass","date":null,"mentions":[{"quote":"Exploiting a zero-day vulnerability (CVE-2023-20867) that enabled the execution of privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs without authentication of guest credentials from a compromised ESXi host and no default logging on guest VMs","start":1228,"end":1495},{"quote":"This blog post describes an expanded understanding of the attack path seen in Figure 1 and highlights the implications of both the zero-day vulnerability (CVE-2023-20867) and VMCI communication sockets the attacker leveraged to complete their goal.","start":1970,"end":2218},{"quote":"The attacker scripts used to install these VIBs, perform anti-forensics to hide these installations, and exploit CVE-2023-20867 to perform unauthenticated Guest Operations are described in the following section.","start":7841,"end":8052},{"quote":"As investigations into UNC3886 activity continued in 2023, Mandiant discovered that the attacker utilized a zero-day vulnerability, CVE-2023-20867, to execute commands and transfer files to and from guest VMs from a compromised ESXi host without the need for guest credentials.","start":9266,"end":9543},{"quote":"Additionally, the use of CVE-2023-20867 does not generate an authentication log event on the guest VM when commands are executed from the ESXi host.","start":9544,"end":9692}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-25040","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-25040","exploited":true,"exploitedSince":"2023-06-23","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1105"],"provenance":"source"}],"timeline":[{"date":"2023-06-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20867","provenance":"source"},{"date":"2023-06-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.mandiant.com/resources/blog/vmware-esxi-zero-day-bypass","provenance":"source"},{"date":"2023-06-23","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-06-23","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-25040","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":10},"priority":{"score":76.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1234 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.29,"detail":"percentile 0.9647"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":2.73,"detail":"base score 3.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}