What is the CVSS score of CVE-2023-20867?

CVE-2023-20867 has a CVSS 3.1 base score of 3.9 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 2.7%.

Is CVE-2023-20867 being actively exploited?

Yes, CVE-2023-20867 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2023-20867?

During next maintenance window: Apply vendor patches when convenient. Vendor patch is available.

CVE-2023-20867

LOW

Improper Authentication (CWE-287)

2023-06-13 security@vmware.com

3.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.9 LOW

AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 26, 2026 - 11:19 vuln.today

Added to CISA KEV

Oct 28, 2025 - 13:46 cisa

CISA KEV

Patch released

Oct 28, 2025 - 13:46 nvd

Patch available

CVE Published

Jun 13, 2023 - 17:15 nvd

LOW 3.9

DescriptionCVE.org

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

Analysis

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

Technical ContextAI

An authentication bypass vulnerability allows attackers to circumvent login mechanisms and gain unauthorized access without valid credentials. This vulnerability is classified as Improper Authentication (CWE-287).

RemediationAI

A vendor patch is available — apply it immediately. Implement robust authentication mechanisms. Use multi-factor authentication. Review authentication logic for bypass conditions. Remove default credentials.