Advisory severityHigh7.1VMware (Broadcom)

High [CVE-2023-20900] VMware Tools: malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html

This high-severity VMware (Broadcom) advisory covers CVE-2023-20900 affecting VMware Tools (open-vm-tools).

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2023-20900 Source published Aug 31, 2023Source updated Oct 8, 2026

VulniPulse record published Oct 8, 2026

CVE-2023-20900

Affected products & platforms

VMware (Broadcom)VMware ToolsvSphere

Open source advisory

Android app · Google Play

Monitor future VMware (Broadcom) CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

A malicious actor that has been granted Guest Operation Privileges in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias. AliasManager.html.

Affected product named by the advisory: VMware Tools (open-vm-tools).

Affected versions

VMware Tools 12.x.x
VMware Tools 11.x.x
VMware Tools 10.3.x
VMware Tools (open-vm-tools) 12.x.x
VMware Tools (open-vm-tools) 11.x.x
VMware Tools (open-vm-tools) 10.3.x

Official advisory · high-confidence parse· fetched 3 days ago·verify at source

Fixed versions

No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.

Official advisory · high-confidence parse· fetched 3 days ago·verify at source

Mitigation

The source record does not include mitigation steps. That is not a statement that no fix exists — read the vendor advisory below for the authoritative guidance.

Official advisory · high-confidence parse· fetched 3 days ago·verify at source

Sources

Official and corroborating records used to build this advisory.

Official vendor advisoryofficial
Official advisory page fetched and parsed; accepted detail fields are attributed to this page.
VMware (Broadcom)
CVE.org CNA recordCVE.org
Independent CNA record used for near-real-time discovery and missed-CVE reconciliation. Discovered from the machine-readable feed https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/delta.json; this link opens the CVE.org record for CVE-2023-20900 instead of the raw feed document.
CVE Program

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2023-20900NVD CVE.org MITRE

Official resources

Broadcom support downloads (ESXi / vCenter patches)
Official documentation
Official upgrade documentation for vSphere (ESXi / vCenter).
VMware product lifecycle (EOL / support dates)
Release notes
Confirm your release train is still supported before planning the upgrade path.
Broadcom / VMware Security Advisories (VMSA)
Official documentation
Canonical VMSA portal — full advisory text, response matrix and fixed-version tables.
VMware docs on Broadcom TechDocs
Official documentation
Official VMware product documentation, including upgrade and patching guides.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.