vulnerability

VMware VMware Tools: CVE-2025-22230: VMware Tools authentication bypass vulnerability

Try Surface Command

Back to search

Severity

CVSS

(AV:L/AC:L/Au:S/C:C/I:C/A:C)

Published

Mar 25, 2025

Added

Jun 3, 2025

Modified

May 18, 2026

Description

VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.8. A malicious actor with non-administrative privileges on a Windows guest VM may gain ability to perform certain high-privilege operations within that VM.

Solution

vmware-tools-upgrade-latest

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25518
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-14973
CVE-2025-22230
https://attackerkb.com/topics/CVE-2025-22230
CWE-288
EUVD-EUVD-2025-14973

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report