What it is
VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.
What to do
Apply updates per vendor instructions.
Vendor notices and references
Description and required action as published by CISA. Full record at NVD.
Other VMware entries on the list
- ESXi, Workstation, and Fusion VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability CVE-2025-22226 · Mar 4, 2025
- ESXi VMware ESXi Arbitrary Write Vulnerability CVE-2025-22225 · Mar 4, 2025
- ESXi and Workstation VMware ESXi and Workstation TOCTOU Race Condition Vulnerability CVE-2025-22224 · Mar 4, 2025
- vCenter Server VMware vCenter Server Privilege Escalation Vulnerability CVE-2024-38813 · Nov 20, 2024
- vCenter Server VMware vCenter Server Heap-Based Buffer Overflow Vulnerability CVE-2024-38812 · Nov 20, 2024
- ESXi VMware ESXi Authentication Bypass Vulnerability CVE-2024-37085 · Jul 30, 2024