Patch & vulnerability status
VMware, Inc.
VMware Tools 10.1.0
Latest tracked version 10.1.0. Release status, tracked CVEs, and automated cross-platform patching for VMware Tools.
| Platform | Latest version | CVEs tracked | Last checked |
|---|---|---|---|
| Windows | 10.1.0 | 21 | 2026-08-10 |
Known vulnerabilities (CVEs) in VMware Tools
Lavawall tracks 21 published CVEs affecting VMware Tools, and deploys the versions that fix them automatically across your fleet.
| CVE | Published | Severity | Details | Vector |
|---|---|---|---|---|
| CVE-2025-41244 | 2025-09-29 17:15:31 | HIGH (8) | VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM. | LOCAL |
| CVE-2023-34058 | 2023-10-27 05:15:39 | HIGH (8) | VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html . | ADJACENT_NETWORK |
| CVE-2023-34057 | 2023-10-27 05:15:39 | HIGH (8) | VMware Tools contains a local privilege escalation vulnerability. A malicious actor with local user access to a guest virtual machine may elevate privileges within the virtual machine. | LOCAL |
| CVE-2023-20867 | 2023-06-13 17:15:14 | LOW (4) | A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. | LOCAL |
| CVE-2022-31693 | 2023-06-07 14:15:10 | MEDIUM (6) | VMware Tools for Windows (12.x.y prior to 12.1.5, 11.x.y and 10.x.y) contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with local user privileges in the Windows guest OS, where VMware Tools is installed, can trigger a PANIC in the VM3DMP driver leading to a denial-of-service condition in the Windows guest OS. | LOCAL |
| CVE-2022-31676 | 2022-08-23 20:15:09 | HIGH (8) | VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine. | LOCAL |
| CVE-2022-22977 | 2022-05-24 19:15:10 | HIGH (7) | VMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains an XML External Entity (XXE) vulnerability. A malicious actor with non-administrative local user privileges in the Windows guest OS, where VMware Tools is installed, may exploit this issue leading to a denial-of-service condition or unintended information disclosure. | LOCAL |
| CVE-2022-22943 | 2022-03-03 22:15:09 | MEDIUM (7) | VMware Tools for Windows (11.x.y and 10.x.y prior to 12.0.0) contains an uncontrolled search path vulnerability. A malicious actor with local administrative privileges in the Windows guest OS, where VMware Tools is installed, may be able to execute code with system privileges in the Windows guest OS due to an uncontrolled search path element. | LOCAL |
| CVE-2021-21999 | 2021-06-23 12:15:08 | HIGH (8) | VMware Tools for Windows (11.x.y prior to 11.2.6), VMware Remote Console for Windows (12.x prior to 12.0.1) , VMware App Volumes (2.x prior to 2.18.10 and 4 prior to 2103) contain a local privilege escalation vulnerability. An attacker with normal access to a virtual machine may exploit this issue by placing a malicious file renamed as `openssl.cnf' in an unrestricted directory which would allow code to be executed with elevated privileges. | LOCAL |
| CVE-2021-21997 | 2021-06-18 13:15:08 | MEDIUM (6) | VMware Tools for Windows (11.x.y prior to 11.3.0) contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with local user privileges in the Windows guest operating system, where VMware Tools is installed, can trigger a PANIC in the VM3DMP driver leading to a denial-of-service condition in the Windows guest operating system. | LOCAL |
| CVE-2020-3972 | 2020-06-19 18:15:11 | LOW (3) | VMware Tools for macOS (11.x.x and prior before 11.1.1) contains a denial-of-service vulnerability in the Host-Guest File System (HGFS) implementation. Successful exploitation of this issue may allow attackers with non-admin privileges on guest macOS virtual machines to create a denial-of-service condition on their own VMs. | LOCAL |
| CVE-2020-3941 | 2020-01-15 20:15:25 | HIGH (7) | The repair operation of VMware Tools for Windows 10.x.y has a race condition which may allow for privilege escalation in the Virtual Machine where Tools is installed. This vulnerability is not present in VMware Tools 11.x.y since the affected functionality is not present in VMware Tools 11. | LOCAL |
| CVE-2019-5522 | 2019-06-06 19:29:01 | LOW (4) | VMware Tools for Windows update addresses an out of bounds read vulnerability in vm3dmp driver which is installed with vmtools in Windows guest machines. This issue is present in versions 10.2.x and 10.3.x prior to 10.3.10. A local attacker with non-administrative access to a Windows guest with VMware Tools installed may be able to leak kernel information or create a denial of service attack on the same Windows guest machine. | LOCAL |
| CVE-2018-6969 | 2018-07-13 13:29:00 | MEDIUM (4) | VMware Tools (10.x and prior before 10.3.0) contains an out-of-bounds read vulnerability in HGFS. Successful exploitation of this issue may lead to information disclosure or may allow attackers to escalate their privileges on the guest VMs. In order to be able to exploit this issue, file sharing must be enabled. | LOCAL |
| CVE-2016-7080 | 2016-12-29 09:59:00 | MEDIUM (5) | The graphic acceleration functions in VMware Tools 9.x and 10.x before 10.0.9 on OS X allow local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors, a different vulnerability than CVE-2016-7079. | LOCAL |
| CVE-2016-7079 | 2016-12-29 09:59:00 | MEDIUM (5) | The graphic acceleration functions in VMware Tools 9.x and 10.x before 10.0.9 on OS X allow local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors, a different vulnerability than CVE-2016-7080. | LOCAL |
| CVE-2016-5330 | 2016-08-08 01:59:16 | HIGH (8) | Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware Tools 10.0.5 in VMware ESXi 5.0 through 6.0, VMware Workstation Pro 12.1.x before 12.1.1, VMware Workstation Player 12.1.x before 12.1.1, and VMware Fusion 8.1.x before 8.1.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory. | LOCAL |
| CVE-2016-5328 | 2016-12-29 09:59:00 | LOW (2) | VMware Tools 9.x and 10.x before 10.1.0 on OS X, when System Integrity Protection (SIP) is enabled, allows local users to determine kernel memory addresses and bypass the kASLR protection mechanism via unspecified vectors. | LOCAL |
| CVE-2015-5191 | 2017-07-28 21:29:00 | LOW (4) | VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H | LOCAL |
| CVE-2014-4200 | 2014-08-28 15:14:09 | MEDIUM (5) | vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, uses 0644 permissions for the vm-support archive, which allows local users to obtain sensitive information by extracting files from this archive. | LOCAL |
| CVE-2014-4199 | 2014-08-28 15:14:09 | MEDIUM (6) | vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, allows local users to write to arbitrary files via a symlink attack on a file in /tmp. | LOCAL |
Why keeping VMware Tools patched matters
Unpatched third-party applications are one of the most common ways attackers get in: 57% of breached MSP clients and 32% of ransomware cases trace back to a missing patch. Every VMware Tools release that fixes a security bug is public, so attackers see it too, and an out-of-date install becomes a documented way in. Tracking the installed version on every machine and closing the gap quickly is what turns a disclosed CVE into a non-event.
How Lavawall® patches VMware Tools
Lavawall® watches VMware Tools releases and CVEs continuously, ranks each update by risk, and deploys it across your whole fleet, Windows, macOS, and Linux, from a single agent, independently of your RMM. You get one place to see which machines are behind on VMware Tools, one policy to bring them current, and timestamped evidence for audits.
Frequently asked questions
What is the latest version of VMware Tools?
Lavawall tracks VMware Tools at version 10.1.0 (last checked 2026-08-10). New releases are monitored continuously and can be deployed automatically across your fleet.
Lavawall tracks VMware Tools at version 10.1.0 (last checked 2026-08-10). New releases are monitored continuously and can be deployed automatically across your fleet.
Does VMware Tools have known security vulnerabilities (CVEs)?
Lavawall tracks 21 CVEs for VMware Tools and remediates them automatically as part of patching.
Lavawall tracks 21 CVEs for VMware Tools and remediates them automatically as part of patching.
How do I patch VMware Tools automatically?
Deploy the Lavawall® agent and VMware Tools updates are applied automatically across Windows, macOS, and Linux, risk-ranked and reported, independently of your RMM.
Deploy the Lavawall® agent and VMware Tools updates are applied automatically across Windows, macOS, and Linux, risk-ranked and reported, independently of your RMM.
Lavawall® monitors releases and CVEs for VMware Tools through public information and proprietary statistical analysis, and can patch it automatically across your fleet.